Subject: RE: ACL ordering

From: "Yoder, Alan" <[email-masked]>
Date: Thu, 28 Nov 2002 11:17:10 -0800

An example of when a non-Windows ordering
is useful is the case in which you want to
allow read access to everyone in the company
except Sales (say), excepting two Sales
VPs who are also allowed.

	Allow		Eric			R
	Allow		Gina			R
	Deny		Sales			R	
	Allow		AuthUsers		R
	Allow		CoreTeam		RW

You can do this without the "inverted"
ordering, but it requires an exhaustive
Allow list of all the groups in the company
except Sales.

Alan

===============================================================
Alan G. Yoder                                    [email-masked]
Technical Staff                          
Network Appliance, Inc.                            408-822-6919
=============================================================== 

> -----Original Message-----
> From: Carl Beame [mailto:[email-masked]]
> Sent: Thursday, November 28, 2002 3:10 AM
> To: [email-masked]; [email-masked]
> Subject: Re: ACL ordering
> 
> 
> On Thu Nov 28 00:30:51 2002, Eric Sedlar wrote:
> > 
> > Therefore, to really achieve Windows interoperability (let 
> alone usability),
> > protocols like NFSv4 should avoid allowing deny ACEs after 
> any grant ACEs.  This
> > also relaxes the requirement to maintain strict ACE 
> ordering, since ordering is
> > irrelevant when processing denies, and ordering is 
> irrelevant when processing
> > grants (other than as an optimization).  I didn't see 
> anything in the spec about
> > what order the inherited ACEs should be placed in (for 
> example relative to a
> > default ACL that might be defined on the server on a 
> per-user basis), so making
> > this ordering requirement clear simplifies the work.
> > 
> 
> This is actually incorrect. The user interfaces which ship 
> with Windows NT order
> the ACEs in a specific order, but the ACL can be stored in an 
> NTFS filesystem in
> ANY order and are evaluated as is defined in the 
> specification. It is easy
> enough to write a GUI which allows you to order then any way you want.
> 
> - Carl
>