linux-kernel - Re: [PATCH v18 00/22] Richacls (Core and Ext4)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160315071103.GC19747@infradead.org>
Date:	Tue, 15 Mar 2016 00:11:03 -0700
From:	Christoph Hellwig <hch@...radead.org>
To:	Andreas Gruenbacher <agruenba@...hat.com>
Cc:	Christoph Hellwig <hch@...radead.org>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	"J. Bruce Fields" <bfields@...ldses.org>,
	Linux NFS Mailing List <linux-nfs@...r.kernel.org>,
	Theodore Ts'o <tytso@....edu>, linux-cifs@...r.kernel.org,
	Linux API <linux-api@...r.kernel.org>,
	Trond Myklebust <trond.myklebust@...marydata.com>,
	LKML <linux-kernel@...r.kernel.org>,
	XFS Developers <xfs@....sgi.com>,
	Andreas Dilger <adilger.kernel@...ger.ca>,
	linux-fsdevel <linux-fsdevel@...r.kernel.org>,
	Jeff Layton <jlayton@...chiereds.net>,
	linux-ext4 <linux-ext4@...r.kernel.org>,
	Anna Schumaker <anna.schumaker@...app.com>
Subject: Re: [PATCH v18 00/22] Richacls (Core and Ext4)

On Fri, Mar 11, 2016 at 05:11:51PM +0100, Andreas Gruenbacher wrote:
> > while breaking a lot of assumptions,
> 
> The model is designed specifically to be compliant with the POSIX
> permission model. What assumptions are you talking about?

People have long learned that we only have 'alloc' permissions.  Any
model that mixes allow and deny ACE is a mistake.

> > especially by adding allow and deny ACE at the same time.
> 
> I remember from past discussions that a permission model like the
> POSIX ACL model that doesn't have DENY ACEs would be more to your
> liking. This argument is dead from the start though: NFSv4 ACLs
> without DENY ACEs cannot represent basic file permissions like 0604
> where the owning group has fewer permissions than others, for example
> (see the richaclex(7) man page). We would end up with a permission
> model that isn't even compatible with the traditional POSIX file
> permission model, one which nobody else implements or cares about.

So let's stick to the model that we already have.