Any hope for new file permission revolution in Linux

kstan · 07-24-2008, 11:44 AM

Linux/Unix'd use standard file permission which is rwx quite many years. However in corporate environment (especially file server) it no longer sufficient.

The implementation of POSIX ACL is better a bit, however it still able to control permission until Read, Write, Execute only.

Anybody think before file permission in Linux shall have revolution, which allow user do have more flexible permission configuration like:
read, modify, write, delete file, delete folder, traverse folder, list content

I not intend to start a war here, Ms. Windows, has NTFS permission features which is superior than any *nix environment.

I hope 1 day linux file permission can support same capablity like windows (I know it can become a really big impact on all *nix softwares)

rocket357 · 07-24-2008, 12:07 PM

Quote:

Originally Posted by kstan

Ms. Windows, has NTFS permission features which is superior than any *nix environment.

This is indeed true. MS Windows has a much more granular control of file permissions than simple rwx.

To counter, have you checked out any of the dozens of Linux security enhancements? (RSBAC, SELinux, grsecurity, etc...?)

custangro · 07-24-2008, 12:13 PM

Quote:

Originally Posted by kstan

read, modify, write, delete file, delete folder, traverse folder, list content

I see no difference between modify and delete...

If I can modify a file; I can open it. Clear EVERYTHING inside...and save it...I couldn't delete it...but it might as well be...

And If I can't delete the folder...but can delete the contents...then it might as well be good as gone...

-C

trickykid · 07-24-2008, 12:15 PM

You could probably get a lot of this functionality if you used AFS. It has better and granular control over files/directories, etc.

kstan · 07-24-2008, 02:04 PM

Quote:

Originally Posted by trickykid

You could probably get a lot of this functionality if you used AFS. It has better and granular control over files/directories, etc.

Thanks, seems like AFS is the real answer for this topic. Below is some text I get from manual:

Quote:

File and Directory Protection

AFS does not rely on the mode bit protections of a standard UNIX system (though its protection system does interact with these mode bits). Instead, AFS uses an access control list (ACL) to control access to each directory and its contents. The following list summarizes the differences between the two methods:

UNIX mode bits specify three types of access permissions: r (read), w (write), and x (execute). An AFS ACL uses seven types of permissions: r (read), l (lookup), i (insert), d (delete), w (write), k (lock), and a (administer). For more information, see The AFS ACL Permissions and How AFS Uses the UNIX Mode Bits.
The three sets of mode bits on each UNIX file or directory enable you to grant permissions to three users or groups of users: the file or directory's owner, the group that owns the file or directory, and all other users. An ACL can accommodate up to about 20 entries, each of which extends certain permissions to a user or group. Unlike standard UNIX, a user can belong to an unlimited number of groups, and groups can be defined by both users and system administrators. See Using Groups.
UNIX mode bits are set individually on each file and directory. An ACL applies to all of the files in a directory. While at first glance the AFS method possibly seems less precise, in actuality (given a proper directory structure) there are no major disadvantages to directory-level protections and they are easier to establish and maintain.

However, is it applicable for centralize authentication (via ldap/active directory)?

trickykid · 07-24-2008, 02:11 PM

Quote:

Originally Posted by kstan

However, is it applicable for centralize authentication (via ldap/active directory)?

Should be, it's technically already setup for centralized type authentications with PAM/Kerberos, etc. I've never used it to authenticate against OpenLDAP or AD but probably doable, I'm sure someones done it before.

kstan · 07-25-2008, 01:16 AM

thanks. its help.