Messages in this thread | | | Subject | Re: [PATCH] 2.6.25: access permission filesystem 0.21 | From | Olaf Dietsche <> | Date | Tue, 13 May 2008 21:06:55 +0200 |
| |
Casey Schaufler <casey@schaufler-ca.com> writes:
> --- Olaf Dietsche <olaf+list.linux-kernel@olafdietsche.de> wrote: > >> This patch adds a new permission managing file system. >> Furthermore, it adds two modules, which make use of this file system. >> >> One module allows granting capabilities based on user-/groupid. > > Hmm. The primary purpose of the capability mechanism, according > to the POSIX P1003.1e/2c working group*, is to separate the > privilege mechanism from the userid mechanism. You are now > reintegrating them two mechanims, albiet differently than > they were integrated before. You can already achieve this end > using filesystem based capabilties and mode bits and/or ACLs, > so why the change?
This idea is from 2002, when there were neither filesystem based capabilties nor ACLs. But since even I never used it, see it as an interesting excercise.
>> The >> second module allows to grant access to lower numbered ports based on >> user-/groupid, too. > > Woof. As reasonable as mode bits on ports seems, there's an > awful lot of tradition associated with the privileged port > model. I can see the value in it, I've actually implemented > it in the past in the Unix world, but I have never seen anyone > willing to take advantage of the scheme.
Well, I'm not in the tradition business :-) but it's fun to do these things and even useful in this case.
Regards, Olaf
| |