Subject: RE: Speaking of ACLs

From: "Yoder, Alan" <[email-masked]>
Date: Wed, 10 Apr 2002 13:11:50 -0700

> I don't think you can set an "ACE4_FILE_INHERIT_ACE" on a 
> file, therefore if
> a client did a GETATTR and then a SETATTR, an ACE might 
> transition from
> inherited to explicit.  Although the spec does not say that 
> an ACE once
> inherited will maintain this distinction, I think it's reasonable to
> consider that a server would want to keep track of this.

   To my knowledge, the equivalent of { READATTR, munge ACL,
SETATTR }, resulting in an explicit ACL, is the current
standard.

   You're proposing a kind of "mixed" ACL, in
which some ACEs are inherited and others are
explicitly set?  Are there any examples of working 
filesystems which do this?  What problem does it 
solve?

Alan

===============================================================
Alan G. Yoder                                    [email-masked]
Network Appliance, Inc.                           
Sunnyvale, CA                                      408-822-6919
===============================================================

---

From: Carl Beame <[email-masked]>
Date: 10 Apr 2002 21:37:00 +0100

> filesystems which do this?  What problem does it 

The intent of the INHERIT_ACE flag was for an ACE which is ONLY on a
directory and has NO meaning for the access to the directory. 

Given a directory with an ACE with the INHERIT_ACE flag set. Any File
created in the Directory receives, on creation, an ACE which is a copy
of the ACE in the parent directory with the INHERIT_ACE flag removed. Any
Directory created in the Directory receives on creation an ACE which
is a copy of the ACE in the parent directory with the INHERIT_ACE flag
removed AND a copy of the ACE in the parent directory with the
INHERIT_ACE flag set. This allows for propogation of ACEs.

- Carl