[lkml]   [2003]   [May]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [OpenAFS-devel] Re: Alternative to PAGs
Garance A Drosihn <> writes:

> What AFS does not want is for a single process to be and
> at the exact same time. That is to avoid the question of
> what open() should do on a file which is permitted:

> drosehn rlidwka
> linus none

An even better example without an obvious answer (which in this case is
that the open should be allowed, since that ACL says that drosehn should
be able to open the file and says nothing about linus) would be if linus
had negative rights (in other words, if the ACL actively asserted that
linus should *not* be able to open the file regardless of the other ACLs).

AFS supports the notion of negative rights primarily in combination with
groups, so you can have a situation like:

Normal rights:
organization:itss rlidwka

Negative rights:
rra rlidwka

where rra is a member of organization:itss. rra will be denied access to
that directory despite the fact that his membership in organization:itss
would normally give him full rights.

Russ Allbery ( <>
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:35    [W:0.031 / U:0.948 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site