From owner-freebsd-questions Tue Mar 19 6:16:37 2002 Delivered-To: freebsd-questions@freebsd.org Received: from dire.bris.ac.uk (dire.bris.ac.uk [137.222.10.60]) by hub.freebsd.org (Postfix) with ESMTP id 22FDF37B400 for ; Tue, 19 Mar 2002 06:16:34 -0800 (PST) Received: from mail.ilrt.bris.ac.uk by dire.bris.ac.uk with SMTP-PRIV with ESMTP; Tue, 19 Mar 2002 14:16:18 +0000 Received: from cmjg (helo=localhost) by mail.ilrt.bris.ac.uk with local-esmtp (Exim 3.16 #1) id 16nKMd-0000Rn-00; Tue, 19 Mar 2002 14:13:23 +0000 Date: Tue, 19 Mar 2002 14:13:23 +0000 (GMT) From: Jan Grant X-X-Sender: cmjg@mail.ilrt.bris.ac.uk To: jason+freebsd@kanda.com Cc: Richard , "freebsd-questions@FreeBSD.ORG" Subject: Re: How to disallow a certain user or group to access a directory and all other users will not be affected In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Tue, 19 Mar 2002, Jan Grant wrote: > On Tue, 19 Mar 2002 jason+freebsd@kanda.com wrote: > > > > Not quite so, typically you use permissions to grant access, ie. user x > > can read/write these files, group y can only read these files and everyone > > else has no access. > > > > Permissions can be turned on their head a bit, eg: user x has no access, > > group y has read only access and everyone else can do anything with them. > > > > With thoughtful use of groups, you should be able to emulate some ACL > > functionality, although it will be fiddlier than with ACLs. > > Yeah; but the problem is that dropping out of a group isn't hard - > otherwise I would've mentioned it :-) Actually, now that I thikn about it, what I wrote isn't fair in the slightest. The same kinds of loopholes that can be used to drop out of groups (generally, going through something that doesn't initgroups properly - eg, a non-suexecing apache) could very well be used to avoid group-based ACLs too. -- jan grant, ILRT, University of Bristol. http://www.ilrt.bris.ac.uk/ Tel +44(0)117 9287088 Fax +44 (0)117 9287112 RFC822 jan.grant@bris.ac.uk Talk is cheap: free, as in beer. As in Real Ale, not that Budweiser rubbish. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message