Subject: RE: Speaking of ACLs

From: [email-masked]
Date: Wed, 10 Apr 2002 17:03:50 -0400

Well, far be it from me to claim to understand why Microsoft does anything,
but I believe the reason is that getting ACLs right is hard.  I want to
craft an ACL that allows and denies the right set of accesses to the right
set of people and apply it to a directory structure just once.  So, imagine
I create a directory for some engineering project and deny access to the
Marketing group so they don't tell customers about something too soon.  At
some point, I might have a file in the directory structure that I want a
Marketing person to read.  Therefore, I'll add an ACL entry that allows that
Marketing person read access to the file.  Since this is an explicit ACE, it
takes precedence over the inherited ACE that would have denied access.

The idea of ACLs automatically propagating through a directory structure is
appealing, the question is in how it's handled.  When POSIX did it, an
inherited ACL because just like any other ACL entry (as I recall).  When
Microsoft did it, they keep track of explicit versus inherited.  They may
actually compute the inherited ACEs on-the-fly, I don't know.

--Tad

-----Original Message-----
From: Khan, Saadia [mailto:[email-masked]]
Sent: Wednesday, April 10, 2002 4:56 PM
To: [email-masked]'; [email-masked]; [email-masked];
[email-masked]; Yoder, Alan
Subject: RE: Speaking of ACLs

why do they want to keep track of that?

Saadia

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Wednesday, April 10, 2002 1:49 PM
> To: [email-masked]; [email-masked]; [email-masked];
> [email-masked]; [email-masked]
> Subject: RE: Speaking of ACLs
> 
> 
> I realize that  the INHERIT_ACE flag is for directories, but 
> the point is
> that some OSes keep track of whether or not an ACE was 
> inherited.  It's not
> unreasonable for NFSv4 to be compatible with that notion.  
> Currently, it is
> not.
> 
> -----Original Message-----
> From: Carl Beame [mailto:[email-masked]]
> Sent: Wednesday, April 10, 2002 4:37 PM
> To: [email-masked]; [email-masked];
> [email-masked]; [email-masked]
> Subject: RE: Speaking of ACLs
> 
> 
> The intent of the INHERIT_ACE flag was for an ACE which is ONLY on a
> directory and has NO meaning for the access to the directory. 
> 
> Given a directory with an ACE with the INHERIT_ACE flag set. Any File
> created in the Directory receives, on creation, an ACE which is a copy
> of the ACE in the parent directory with the INHERIT_ACE flag 
> removed. Any
> Directory created in the Directory receives on creation an ACE which
> is a copy of the ACE in the parent directory with the INHERIT_ACE flag
> removed AND a copy of the ACE in the parent directory with the
> INHERIT_ACE flag set. This allows for propogation of ACEs.
> 
> - Carl
>

---

From: Carl Beame <[email-masked]>
Date: 10 Apr 2002 22:13:07 +0100

On Wed Apr 10 22:03:50 2002,  wrote:
  I want
> to

Not true! The file which you want to allow access when it is created
will have an ORDINARY ACE which prohibits access to the Marketing
Department. To change this you use Microsofts tools which below the
surface will read the existing ACEs and add an ALLOW ACE for the
Marketing person before the ACE for disallowing the Marketing
Departmant and then rewrite the ACL to disk.

> actually compute the inherited ACEs on-the-fly, I don't know.

No.  ACEs on parent directories have NO bearing on the ACE of the
file. The only time it does is at the instant of creation. If a client
NFS wants to set a specific ACE on a newly created file it should read
the ACEs from the file just after creation to see what inherited ACEs
the server gave it.

- Carl