ACL permission definitions

[Robert Watson]

On Mon, 9 Apr 2001, Chris Faulhaber wrote:

> I found that we define ACL_PERM_(READ|WRITE|EXEC) while the spec
> (POSIX.1e, 23.2.2) states the proper definitions are ACL_EXECUTE,
> ACL_READ, and ACL_WRITE.  Oddly enough, I could have sworn that
> ACL_PERM_* was the standard, but it seems to not be the case. 

Bizarre.  On re-reading the spec, that indeed appears to be the case. 
Don't know where I picked that up from -- perhaps a late-night reading of
the Solaris or IRIX include files.  Please feel free to go ahead and fix
that. 

> Additionally, we still lack proper internal and external acl
> definitions.  AFAICT, this will be required for a proper acl_get_entry()
> function which takes ACL_FIRST_ENTRY or ACL_NEXT_ENTRY as an argument,
> requiring a placeholder to track the current entry. 
> 
> Finally, we still need ACL_UNDEFINED_TAG and ACL_UNDEFINED_ID
> definitions to complete the list.

The idea of using VNOVAL (-1) is tempting, as it's already a reserved
value in VFS.  However, handling of VNOVAL is fairly buggy due to nasty
interactions in vop_getattr and vop_setattr with reserved numbers
(something that affected NFS until NFSv3).  Are these values that will be
seen by applications using the interface, seen by the implementation (in
particular, the kernel), or both?

> I have a patch at http://www.fxp.org/jedgar/FreeBSD/acl_fixes.diff that
> corrects ACL_PERM_*, adds ACL_(FIRST|NEXT)_ENTRY, ACL_UNDEFINED_TAG, and
> ACL_UNDEFINED_ID.  Work is underway to finish the external/internal acl
> representation so acl_get_entry() can be completed.  Comments/concerns
> are appreciated.

The patch looks good to me, although I haven't done a test compile.

Robert N M Watson             FreeBSD Core Team, TrustedBSD Project
robert at fledge.watson.org      NAI Labs, Safeport Network Services



To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-discuss" in the body of the message