Slashdot Mirror
FreeBSD Access Control Lists
BSD Forums writes "The Unix permissions model has worked for decades due to its flexible simplicity. It's not the only approach, though. FreeBSD 5.0 supports Access Control Lists, which allow for more flexible permissions. Daniel Harris explains what ACLs can make easier."
But Windows NT has had ACLs for some time now.
A lot of people have derided the concept.
But as far as I can see, they are a complete superset of the Un*x system.
It's pretty hard to argue that it's not as good.
Discuss.
Well, the answer is to assign the permission to a group, not to Bob directly. But, drat, then you are back to using groups. :)
The prime problem which ACLs solve or rather work-around, is that users:
- have no way to specify their own collection of users (they have to ask the admin to create a group)
AND
- a user can not chgrp a file to any group of which they are not a member (security)
ACLs provide normal users a means to assign permissions to files by arbitrary users, and (iirc) arbitrary groups. But they are, as you point out, a management nightmare - while being a feature very few people actually need.
I use Friend/Foe + mod-point modifiers as a karma/reputation system.
I had a directory that I wanted 777 for all but user www. The solution was simple with ACL's; it eliminated the need for adding a new group for one measly dir.
Go ACL's!
It's not like FreeBSD is the first to have ACLs. Solaris and Linux both support them as well.
One thing I like under Solaris ACLs is you can set a "default" permission. I always have my default umask set to 027, but I do some collaborative work in some shared directories and it's nice to be able to force any files created in that directory to be writeable by the group. ACLs on Solaris completely ignore the umask.
Under Linux, however, the ACLs work with the umask. I can set default permissions for a directory to be group read-only and files created by someone with a 007 umask will be set to read-only, but I can't do the opposite.
I believe Linux is doing the POSIXly correct thing, but I don't find it very useful.
-- Don't Tase me, bro!
As far as I can see, the ACLs in FreeBSD/UFS2 (following the POSIX.1e proposal) just know the traditional read-write-execute/search permissions, only with more fine-grained possibilities to assign these rights to users and groups. However, the FreeBSD implementation seems to be flexible enough to support additional flags - in fact, the acl(3) manpage explicitly mentions nonportable functions for Netware style ACLs (and some others, like NTFS). I have no idea how to actually use that, however.
Programming can be fun again. Film at 11.
95% of the time they just increase overhead for the admins, but for that 5% that you really NEED them for, they are a godsend...
---- Booth was a patriot ----