From owner-freebsd-security Sun Aug 19 18:37:16 2001 Delivered-To: freebsd-security@freebsd.org Received: from smtp.pace.edu (ntutil.pace.edu [205.232.111.9]) by hub.freebsd.org (Postfix) with ESMTP id C3BB337B408; Sun, 19 Aug 2001 18:37:08 -0700 (PDT) (envelope-from js43064n@pace.edu) Received: from stmail.pace.edu (205.232.111.7) by smtp.pace.edu (LSMTP for Windows NT v1.1b) with SMTP id <0.A8C6DA01@smtp.pace.edu>; 19 Aug 2001 21:37:08 -0400 Date: Sun, 19 Aug 2001 21:37:06 -0400 Message-Id: <200108192137.AA78709278@stmail.pace.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii From: "Jonathan Slivko" Reply-To: X-Sender: To: Ken Cross , Robert Watson Cc: Subject: Re: DENY ACL's X-Mailer: Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org But there is 1 thing that both of you forgot to account for, how much load it would take in order for the deny ACL's to be loaded and to be read, several times over in a given hour. Any comments on that front? -- Jonathan -- Jonathan M. Slivko js43064n@pace.edu Head Systems Administrator 4EverMail Hosting Services -- ---------- Original Message ---------------------------------- From: Robert Watson Date: Sun, 19 Aug 2001 21:29:59 -0400 (EDT) > >On Sun, 19 Aug 2001, Ken Cross wrote: > >> The current Posix.1e ACL implementation in -current works great as far >> as it goes. I'm sure this has been kicked around before (although I >> couldn't find anything in the archives), but it seems like adding "deny" >> ACL's would be a useful and fairly straightforward extension. >> >> For those not familiar with it, deny ACL's are ACL's that explicitly >> deny access, e.g., group Accountants are allowed access, but user George >> is denied access even though he is a member of Accountants. >> >> They are used extensively in the Windows NT/2K world and I need to >> support them on a BSD platform. The implementation is pretty >> straightforward -- always check deny ACL's first and then access ACL's. >> They'd just be a new acl_type_t value (ACL_TYPE_DENY?). >> >> I'd be happy to help with the implementation (especially since I'll be >> doing it regardless). Any interest or things I should know about? > >There are some interesting questions about how you would combine the >POSIX.1e ACL evaluation with subtractive rights of the sort you're >talking >about. POSIX.1e does evaluation by a combination of first/best match. >It evaluates based on a "first match" of the general class of rights, and >then "best match" within that class. Here's the current algorithm based >on what's defined in POSIX.1e: > >Select a "matching" class using the following: > >(1) if effective uid == the file owner, then the file owner permissions >are used > >(2) if the effective uid == one of the additional users, then the >additional user permissions in question are used > >(3) "best match" from effective gid and additional groups using the base >group permissions and additional groups. "best" in this case is defined >as the first gid match that grants all the rights requested. I don't >believe that, in the event there are multiple matches, there is a defined >ordering for the match, but in the FreeBSD implementation, it matches the >effective uid before additional groups. > >(4) other > >So, if you want "subtractive rights" that mix with positive rights, we'll >actually need to fundamentally modify how the algorithm executes. Right >now, it is possible to express some sorts of "negative" rights by taking >advantage of knowledge of the fixed matching components of the algorith; >the "best" matching in the group section does foil some useful attempts. > >You might want to bring this up on the POSIX.1e mailing list, btw, and see >what thoughts the developers of other platforms have on the topic, or >whether this has been approached on other POSIX.1e-esque platforms. I'm >glad that the existing ACL implementation is coming in useful for you. > >Robert N M Watson FreeBSD Core Team, TrustedBSD Project >robert@fledge.watson.org NAI Labs, Safeport Network Services > > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-security" in the body of the message > __________________________________________________________________ ____ Sent via the Pace University Mail system at stmail.pace.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message