5 ms·
And behind on a lot of stuff. The Microsoft's ACLs are nothing short of one of the best designed permission systems there are. On the surface, they are as simp
by 7bit 10mo ago
And behind on a lot of stuff. The Microsoft's ACLs are nothing short of one of the best designed permission systems there are.
On the surface, they are as simple as Linux UOG/rwx stuff if you want it to be, but you can really, REALLY dive into the technology and apply super specific permissions.
- trueismywork 10mo agoYou have ACLs on linux too
- deleted 10mo ago[deleted]
- Arainach 10mo agoACLs in Linux were tacked on later; not everything supports them properly. They were built into Windows NT from the start and are used consistently across kernel and userspace, making them far more useful in practice. Also, as far as I know Linux doesn't support DENY ACLs, which Windows does.
- onraglanroad 10mo agoYes it does.
- 112233 10mo agosince when?
- onraglanroad 10mo agoSince some of us could be bothered reading docs. Give it a try and see how it works out for you.
- 112233 10mo agoSome of us can! I certainly enjoy doing it, and according to "man 5 acl" what you assert is completely false. Unless you have a particular commit or document from kernel.org you had in mind?
- opello 10mo ago> Each of these characters is replaced by the - character to denote that a permission is absent in the ACL entry. Wouldn't the o::--- default ACL, like mode o-rwx, deny others access in the way you're describing?
- 112233 10mo agoSee 6.2.1 of RFC8881, where NFSv4 ACLs are described. They are quite similar to Windows ACLs. Here is kernel dev telling they are against adding NFSv4 ACL implementation. The relevant RichAcls patch never got merged: https://lkml.org/lkml/2016/3/15/52 https://lkml.org/lkml/2016/3/15/52
- opello 10mo agohttps://www.rfc-editor.org/rfc/rfc8881#section-6.2.1 https://www.rfc-editor.org/rfc/rfc8881#section-6.2.1 I see what I misunderstood, even in the presence of an ALLOW entry, a DENY entry would prohibit access. I am familiar with that on the Windows side but haven't really dug into Linux ACLs. The ACCESS CHECK ALGORITHM[1] section of the acl(5) man page was pretty clear, I think. [1] https://man7.org/linux/man-pages/man5/acl.5.html#ACCESS_CHECK_ALGORITHM https://man7.org/linux/man-pages/man5/acl.5.html#ACCESS_CHEC...
- 112233 10mo agoHaha, sure. Sorry, it's not you, it's the ACLs (and me nerves). Have you tried configuring NFSv4 ACLs on Linux? Because kernel devs are against supporting them, you either use some other OS or have all sorts of "fun". Also, not to be confused with all sorts of LSM based ACLs... Linux has ACLs in the most ridiculous way imaginable...
- 7bit 10mo agoNot by default. Not as extensive as in Windows. What's your point?
- bbkane 10mo agoDo you have any favorite docs or blogs on these? Reading about one of the best designed permissions systems sounds like a fun way to spend an afternoon ;)
- torginus 10mo agoAnd they work on everything. You can have a mutex, a window handle or a process protected by ACL.
- dabockster 10mo agoOh yeah for sure. Linux is amazing in a computer science sense, but it still can't beat Windows' vertically integrated registry/GPO based permissions system. Group/Local Policy especially, since it's effectively a zero coding required system. Ubuntu just recently got a way to automate its installer (recently being during covid). I think you can do the same on RHEL too. But that's largely it on Linux right now. If you need to admin 10,000+ computers, Windows is still the king.
- esseph 10mo ago> Ubuntu just recently got a way to automate its installer (recently being during covid). I think you can do the same on RHEL too. But that's largely it on Linux right now. If you need to admin 10,000+ computers, Windows is still the king. 1. cloud-init support was in RHEL 7.2 which released November 19, 2015. A decade ago. 2. Checking on Ubuntu, it looks like it was supported in Ubuntu 18.04 LTS in April 2018. 3. For admining tens of thousands of servers, if you're in the RHEL ecosystem you use Satellite and it's ansible integration. That's also been going on for... about a decade. You don't need much integration though other than a host list of names and IPs. There are a lot of people on this list handling tens of thousands or hundreds of thousands of linux servers a day (probably a few in the millions).
- LeSaucy 10mo agoStill the king but developing/testing/debugging group policy issues is a miserable experience.
- 7bit 10mo agoI always found it straight forward. Never had an issue and I've implemented my fair share on thousands on devices and servers.
- lll-o-lll 10mo agoNot an implementer of group policy, more of a consumer. There are 2 things that I find extremely problematic about them in practice. - There does not seem to be a way to determine which machines in the fleet have successfully applied. If you need a policy to be active before doing deployment of something (via a different method), or things break, what do you do? - I’ve had far too many major incidents that were the result of unexpected interactions between group policy and production deployments.
- jandrese 10mo ago> The Microsoft's ACLs are nothing short of one of the best designed permission systems there are. You have a hardened Windows 11 system. A critical application was brought forward from a Windows 10 box but it failed, probably a permissions issue somewhere. Debug it and get it working. You can not try to pass this off to the vendor, it is on you to fix it. Go.
- butlike 10mo agoand why is it not on the vendor of the critical application?
- jandrese 10mo agoBecause they aren't allowed on the system where it is installed, and also they don't deal with hardened systems.
- 7bit 10mo agoProcmon.exe. Give me 2 minutes. You make it sound like it's such a difficult thing to do. It literally will not take me more than 2 minutes to tell you exactly where the permission issue is and how to fix it.
- roblabla 10mo agoProcmon won't show you every type of resource access. Even when it does, it won't tell you which entity in the resource chain caused the issue. And then you get security product who have the fun idea of removing privileges when a program creates a handle (I'm not joking, that's a thing some products do). So when you open a file with write access, and then try to write to the file, you end up with permission errors durig the write (and not the open) and end up debugging for hours on end only to discover that some shitty security product is doing stupid stuff... Granted, thats not related to ACLs. But for every OK idea microsoft had, they have dozen of terrible ideas that make the whole system horrible.
- 10mo ago
- nunez 10mo agoThe file permission system on Windows allows for super granular permissions, yes; administrating those permissions was a massive pain, especially on Windows file servers.
- Eggpants 10mo agoAnd yet, it requires kernel extension anti-cheat to stop a game mod from reading and writing memory locations in a running process. It’s a toy operating system if it can’t even prevent that. It’s why corporate machines are so locked down. Then there is the fact video drivers run in ring 0 and are allowed to phone home… but hey you can prevent notepad++ from running FTW.