3 ms·

Microsoft brings its own problems in. While it's true that NT's security model is much stronger than the Unix style (no ACLs on anything??), MS has really gone

Microsoft brings its own problems in. While it's true that NT's security model is much stronger than the Unix style (no ACLs on anything??), MS has really gone overboard recently. Install IIS and see the myriad things to check off. Dynamic compression is separate from static compression and you must install them apart from IIS alone. The absolute best example: You cannot listen to HTTP without extra permissions. You can bind to port 80 and parse HTTP yourself. But if you ask Windows to do that for you, it's access denied. This is entirely illegitimate and many people just deal with it by running with admin permissions, rather than screw around trying to setup ACLs on HTTP prefixes. (The only context in which it makes sense is port sharing, so as to register certain prefixes. But in that case the port'll already be in use.)

technofiend 10y ago
Depending on OS flavor UNIX has had ACLs piled on top of the classic owner-group-other security model for decades. SELinux in particular has decent ACL capabilities. By default Apache's policy allows listening on port 80 and a few other well known ports - you can configure the app to listen on $RANDOM_PORT but all that'll get you is an error in a logfile until you use semanage to fix it. Or did I misunderstand your statement about no ACLs on anything?
- MichaelGG 10y ago
  I mean the default Unix model, like filesystem permissions, just have the very limited owner-group-everyone bits, nothing serious. SELinux does add a lot in but it's more of a bolt-on right? Compared to Windows where every thing, even an individual thread or other objects, come with ACLs.
  - Tiksi 10y ago
    Linux supports POSIX ACLs, which I would classify as "default Unix" since it's POSIX, and also supports some extended non-portable ACLs: http://linux.die.net/man/5/acl http://linux.die.net/man/5/acl http://www.vanemery.com/Linux/ACL/POSIX_ACL_on_Linux.html http://www.vanemery.com/Linux/ACL/POSIX_ACL_on_Linux.html

technofiend 10y ago

Depending on OS flavor UNIX has had ACLs piled on top of the classic owner-group-other security model for decades. SELinux in particular has decent ACL capabilities. By default Apache's policy allows listening on port 80 and a few other well known ports - you can configure the app to listen on $RANDOM_PORT but all that'll get you is an error in a logfile until you use semanage to fix it. Or did I misunderstand your statement about no ACLs on anything?

MichaelGG 10y ago
I mean the default Unix model, like filesystem permissions, just have the very limited owner-group-everyone bits, nothing serious. SELinux does add a lot in but it's more of a bolt-on right? Compared to Windows where every thing, even an individual thread or other objects, come with ACLs.
- Tiksi 10y ago
  Linux supports POSIX ACLs, which I would classify as "default Unix" since it's POSIX, and also supports some extended non-portable ACLs: http://linux.die.net/man/5/acl http://linux.die.net/man/5/acl http://www.vanemery.com/Linux/ACL/POSIX_ACL_on_Linux.html http://www.vanemery.com/Linux/ACL/POSIX_ACL_on_Linux.html