On Tuesday, October 11, 2005 11:15:30 AM -0700 Adam Megacz
<[EMAIL PROTECTED]> wrote:
Jeffrey Hutzelman <[EMAIL PROTECTED]> writes:
thing. It does some pretty hideous things to get something approaching
reasonable security semantics, given the assumptions people make about
how access controls work on UNIX filesystems.
Could you elaborate on this? My understanding was that it simply
didn't bother to support security (all files are read-only,
world-readable)
Not at all true. It maps users' credentials onto a local uid based on
passwd file and .klogin lookups (it is possible to request a specific
username using a hostafs-specific client utility, but this is still subject
to a .klogin check). It then simulates ACL's and performs access checks
based on the user's identity and the owner and mode bits of the files being
accessed (no, it doesn't use access(2); this was a proof-of-concept and
that would have been more work since we'd have had to map unix modes onto
AFS access rights anyway). For users who don't have accounts on the
server, it can be configured to provide different sets of rights to
local-realm, foreign-realm, and unauthenticated users, again based on the
mode bits (at present, the place that would look up this configuration just
hard-codes the results instead, but it's easy to change).
Perhaps you're thinking of tafssrv, a trivial fileserver I wrote more
recently for the purpose of exporting small amounts of relatively-static
content.
_______________________________________________
OpenAFS-info mailing list
[email protected]
https://lists.openafs.org/mailman/listinfo/openafs-info
