3 ms·

You have ACLs on linux too

deleted 10mo ago
[deleted]
Arainach 10mo ago
ACLs in Linux were tacked on later; not everything supports them properly. They were built into Windows NT from the start and are used consistently across kernel and userspace, making them far more useful in practice. Also, as far as I know Linux doesn't support DENY ACLs, which Windows does.
- onraglanroad 10mo ago
  Yes it does.
  - 112233 10mo ago
    since when?
    - onraglanroad 10mo ago
      Since some of us could be bothered reading docs. Give it a try and see how it works out for you.
      - 112233 10mo ago
        Some of us can! I certainly enjoy doing it, and according to "man 5 acl" what you assert is completely false. Unless you have a particular commit or document from kernel.org you had in mind?
        opello 10mo ago
        > Each of these characters is replaced by the - character to denote that a permission is absent in the ACL entry. Wouldn't the o::--- default ACL, like mode o-rwx, deny others access in the way you're describing?
        112233 10mo ago
        See 6.2.1 of RFC8881, where NFSv4 ACLs are described. They are quite similar to Windows ACLs. Here is kernel dev telling they are against adding NFSv4 ACL implementation. The relevant RichAcls patch never got merged: https://lkml.org/lkml/2016/3/15/52 https://lkml.org/lkml/2016/3/15/52
        opello 10mo ago
        https://www.rfc-editor.org/rfc/rfc8881#section-6.2.1 https://www.rfc-editor.org/rfc/rfc8881#section-6.2.1 I see what I misunderstood, even in the presence of an ALLOW entry, a DENY entry would prohibit access. I am familiar with that on the Windows side but haven't really dug into Linux ACLs. The ACCESS CHECK ALGORITHM[1] section of the acl(5) man page was pretty clear, I think. [1] https://man7.org/linux/man-pages/man5/acl.5.html#ACCESS_CHECK_ALGORITHM https://man7.org/linux/man-pages/man5/acl.5.html#ACCESS_CHEC...
112233 10mo ago
Haha, sure. Sorry, it's not you, it's the ACLs (and me nerves). Have you tried configuring NFSv4 ACLs on Linux? Because kernel devs are against supporting them, you either use some other OS or have all sorts of "fun". Also, not to be confused with all sorts of LSM based ACLs... Linux has ACLs in the most ridiculous way imaginable...
7bit 10mo ago
Not by default. Not as extensive as in Windows. What's your point?

deleted 10mo ago

[deleted]

ACLs in Linux were tacked on later; not everything supports them properly. They were built into Windows NT from the start and are used consistently across kernel and userspace, making them far more useful in practice. Also, as far as I know Linux doesn't support DENY ACLs, which Windows does.

onraglanroad 10mo ago
Yes it does.
- 112233 10mo ago
  since when?
  - onraglanroad 10mo ago
    Since some of us could be bothered reading docs. Give it a try and see how it works out for you.
    - 112233 10mo ago
      Some of us can! I certainly enjoy doing it, and according to "man 5 acl" what you assert is completely false. Unless you have a particular commit or document from kernel.org you had in mind?
      - opello 10mo ago
        > Each of these characters is replaced by the - character to denote that a permission is absent in the ACL entry. Wouldn't the o::--- default ACL, like mode o-rwx, deny others access in the way you're describing?
        112233 10mo ago
        See 6.2.1 of RFC8881, where NFSv4 ACLs are described. They are quite similar to Windows ACLs. Here is kernel dev telling they are against adding NFSv4 ACL implementation. The relevant RichAcls patch never got merged: https://lkml.org/lkml/2016/3/15/52 https://lkml.org/lkml/2016/3/15/52
        opello 10mo ago
        https://www.rfc-editor.org/rfc/rfc8881#section-6.2.1 https://www.rfc-editor.org/rfc/rfc8881#section-6.2.1 I see what I misunderstood, even in the presence of an ALLOW entry, a DENY entry would prohibit access. I am familiar with that on the Windows side but haven't really dug into Linux ACLs. The ACCESS CHECK ALGORITHM[1] section of the acl(5) man page was pretty clear, I think. [1] https://man7.org/linux/man-pages/man5/acl.5.html#ACCESS_CHECK_ALGORITHM https://man7.org/linux/man-pages/man5/acl.5.html#ACCESS_CHEC...

112233 10mo ago

Haha, sure. Sorry, it's not you, it's the ACLs (and me nerves). Have you tried configuring NFSv4 ACLs on Linux? Because kernel devs are against supporting them, you either use some other OS or have all sorts of "fun". Also, not to be confused with all sorts of LSM based ACLs... Linux has ACLs in the most ridiculous way imaginable...

7bit 10mo ago

Not by default. Not as extensive as in Windows. What's your point?