Subject: ACL ordering

From: "Eric Sedlar" <[email-masked]>
Date: Wed, 27 Nov 2002 16:30:51 -0800

One issue that has come out in the ACL spec we're standardizing for WebDAV is the issue about restricting ACE order in an ACL.  While it isn't enforced by the Windows kernel, all Windows clients force any deny ACEs to come before the grant ACEs.  This avoids weird processing errors such as the following list of ACEs:

<grant READ>
<deny READ>
<grant WRITE>

Now, if I ask NT for read permission, I get it, since the evaluation short circuits after the first ACE.  If I ask NT for write permission, I get it, since the first two ACEs are ignored.  If I ask NT for read AND write permission, the request is denied, since I don't have all the permission I need after the first ACE, and the second ACE will cause the access check to fail.

Therefore, to really achieve Windows interoperability (let alone usability), protocols like NFSv4 should avoid allowing deny ACEs after any grant ACEs.  This also relaxes the requirement to maintain strict ACE ordering, since ordering is irrelevant when processing denies, and ordering is irrelevant when processing grants (other than as an optimization).  I didn't see anything in the spec about what order the inherited ACEs should be placed in (for example relative to a default ACL that might be defined on the server on a per-user basis), so making this ordering requirement clear simplifies the work.

--Eric

---

From: Carl Beame <[email-masked]>
Date: 28 Nov 2002 11:10:23 +0000

On Thu Nov 28 00:30:51 2002, Eric Sedlar wrote:
> 
> Therefore, to really achieve Windows interoperability (let alone usability),
> protocols like NFSv4 should avoid allowing deny ACEs after any grant ACEs.  This
> also relaxes the requirement to maintain strict ACE ordering, since ordering is
> irrelevant when processing denies, and ordering is irrelevant when processing
> grants (other than as an optimization).  I didn't see anything in the spec about
> what order the inherited ACEs should be placed in (for example relative to a
> default ACL that might be defined on the server on a per-user basis), so making
> this ordering requirement clear simplifies the work.
> 

This is actually incorrect. The user interfaces which ship with Windows NT order
the ACEs in a specific order, but the ACL can be stored in an NTFS filesystem in
ANY order and are evaluated as is defined in the specification. It is easy
enough to write a GUI which allows you to order then any way you want.

- Carl

---

From: "Eric Sedlar" <[email-masked]>
Date: Thu, 28 Nov 2002 23:07:06 -0800

We don't disagree.  I'm just telling you what we heard from Microsoft
regarding
supporting NT ACLs via WebDAV.  Their recommendation was to treat WebDAV
like a client UI and to force ordering, as they may plan to restrict the
ordering of ACEs in
future versions of Windows.

--Eric