Subject: Interaction between mode bits and acls

From: "Khan, Saadia" <[email-masked]>
Date: Tue, 9 Apr 2002 15:47:18 -0700

Hi,

I dont see anything in the spec that talks about how the mode bits and acls should interact with each other if both 
are present. I would say once an acl has been created on an object, all perm checks should be done relative to
that and a best effort mapping should be done for the mode bits only to be used as display permissions such as
when someone does an 'ls -l'. However there can be issues with accessing files if a user sets the permissions 
using acls and another user on a different client (without acl support, can be v2/v3 client) tries to access the file 
based on what he sees from 'ls -l'.

The other option of keeping them both consistent with each other at all times and doing permission checks using
both doesn;t seem very appealing and also involves extra work on the part of the server.

Any suggestions or feedback on this issue would be appreciated. What are other implementations doing?

thanks.
Saadia

---

From: John Howard <[email-masked]>
Date: Tue, 09 Apr 2002 20:52:37 -0400

In my experience (with AFS), mode bits and ACLS operated independently; either could deny access to a given object.  The thinking went something like this:

a) they are useful for different things.  ACLs are best for security/authorization, by virtue of their flexibility in specifying authorized individuals and groups.  On the other hand, mode bits are useful for protection against blunders, for example denying write access to backup copies, or execute access to non-executable files.

b) even minor changes to the way mode bits work will break some applications, which have had 30 years to discover peculiar ways to use them.  Translating back and forth is almost certain to introduce deviations from the expected behavior.

c) it was relatively simple to state the combination rule.  Simplicity is almost always better.

AFS servers enforced ACL access.  I don't remember who enforced mode bits, but by this argument it might as well be clients.

John Howard

---

From: Carl Beame <[email-masked]>
Date: 10 Apr 2002 11:12:52 +0100

On Tue Apr 09 23:47:18 2002, Khan, Saadia wrote:
> Hi,
> 
> I dont see anything in the spec that talks about how the mode bits and
> acls should interact with each other if both 
> are present. I would say once an acl has been created on an object,
> all perm checks should be done relative to
> that and a best effort mapping should be done for the mode bits only
> to be used as display permissions such as
> when someone does an 'ls -l'. However there can be issues with
> accessing files if a user sets the permissions 
> using acls and another user on a different client (without acl
> support, can be v2/v3 client) tries to access the file 
> The other option of keeping them both consistent with each other at
> all times and doing permission checks using

The original intention (at least what I thought it should be) was that
the server would implement what it's own filesystem security would
allow and then translate this to the NFS V4 ACL specification. 

I would suggest the following interpretation if the above is not true:

1) ACLs are scanned in order, when an entry is found which
matches the "user" (could be the user's group etc) and explicitly
grants or denys the access method requested, scanning stops and the
result is returned.

2) If no ACL is found which matches the "user" and the requested
access method, the mode bits are then consulted.

- Carl