Date: Sun, 16 Sep 2012 22:11:26 -0500 (CDT) From: Robert Bonomi <bonomi@mail.r-bonomi.com> To: freebsd-questions@freebsd.org Subject: Re: What are negative permissions? Message-ID: <201209170311.q8H3BQeI030804@mail.r-bonomi.com> In-Reply-To: <CAHu1Y72kt22JmWR1CpaQT%2B4=oQXgdEVkFxjWYge%2B7E_tDHGC7Q@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> Michael Sierchio <kudzu@tenebras.com> wrote: > On Sun, Sep 16, 2012 at 12:50 PM, Matthias Apitz <guru@unixarea.de> wrote: > > El dia Sunday, September 16, 2012 a las 08:37:48PM +0100, Matthew Seaman > > escribio: > > > > > It's where the group ownership of a file gives it fewer permissions than > > > are allowed for the world in general. > > > > > > Suppose you have a file with these permissions and ownership: > > > > > > foo bar -rwx---r-x > > > > > > ... > > > > So far so good (and correct) the theory. But, could you imagine a real > > world example where this makes any sense? > > Group permissions are rather blunt, and if you want fine-grained access > controls, you'll need to enable ACLs. However... > > Imagine, if you will, a group entitled "guest," with the semantics you > might normally associate with that name - then using negative group > permissions on a directory effectively prevents traversal beyond that point > for members of that group. It's also 'convenient' for an anonymous ftp 'upload' directory -- set the upload directory permissions to '-w--w-rw-' and any 'username' in the 'anonymous' group can only upload files to that directory -- can't get a directory listing, read any files, or change directory. BUT, any 'non-anonymous' user _can_ do those things. There are many kinds of "special case" scenarios where it is desirable to make something 'generally available' to ths users, but -deny- access to a specific group of users. "Negative permissions" is a simple, and simplistic, approach to the issue -- but it is a 'traditional' one, from the days before extended access-control lists.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201209170311.q8H3BQeI030804>