Re: POSIX ACL API in glibc?

[Andreas Gruenbacher <agruen at suse dot de>]

On Monday 26 August 2002 21:41, Christoph Hellwig wrote:
> On Mon, Aug 26, 2002 at 09:17:39PM +0200, Andreas Jaeger wrote:
> > AFAIK this is the best current available interface. We can either use
> > implement the draft in glibc (where those functions belong IMO), or
> > leave it to somebody else to implement and provide them.
>
> Someone (Andreas G) already did it.

I have been thinking about alternatives for some time, and came to the 
conclusion that the ACL sections in the POSIX 1003.1e draft 17 document are a 
useful compromise between retaining compatibility with legacy POSIX 
applications, and enabling ACLs. The draft specification has some obvious 
flaws, and needs a few small extensions to be fully usable. Nevertheless 
nothing else comes close enough in achieving the goals (of the 1003.1e 
working group, which are defined in Appendix B of 1003.1e).

There have been attempts to drive the standardization process further from 
draft 17, but nothing has happened since years, and it's quite unlikely that 
this will change anytime soon.

> > IMO the questions are:
> > - Should the ACL functions implemented according to the draft?
>
> I'd vote for "yes".

Various UNIX like operating systems have implemented 1003.1e drafts at 
different stages. As far as I know Irix, FreeBSD and my implementation are 
compatible with 1003.1e (the Irix implementation was not complete the last 
time I looked), and others like HP-UX and Solaris have implemented earlier 
drafts. The differences between these implementations are noticable, but not 
impossible to work around.

> > - Or is there a better userland interface?
>
> I don't know of one.

If I knew of a useful alternative, I would probably immediately go and 
implement it.

> > - Should this interface go into glibc?
>
> Personally I'd prefer a libposix1e, not sure if it should be part of
> glibc.

Well, libposix1e used to be the name of library containing the Capabilities 
subset of 1003.1e draft 17. The name just didn't seem appropriate for me to 
use for a library that contained only a subset of 1003.1e.

> > - Is this the appropriate time to add the interfaces to glibc?
>
> I don't think so.  The only thing that could be added now are the purely
> userspace parts (e.g. conversation between different formats), as the
> kernel interface hasn't been made official yet for Linux and there isn't
> one yet for the hurd.

True. So let's try to get the kernel portion settled first.

> Also integration of the AIX and FreeBSD ports
> might be interesting as they have slighly different kernel ACL
> interfaces.

I know too little about AIX to be able to judge, but FreeBSD should be no 
serious problem.

--Andreas.

------------------------------------------------------------------
 Andreas Gruenbacher                                SuSE Linux AG
 mailto:agruen@suse.de                     Deutschherrnstr. 15-19
 http://www.suse.de/                   D-90429 Nuernberg, Germany