On Tue, 31 May 2011 16:05:23 -0400
Bryan Kearney <bkearney(a)redhat.com> wrote:
>>> Can an object have more than one group tag?
>> It would need to from what I understand.
> What's the point? A group is just an ACL that's factored out from
> an object so one named ACL can apply to many objects. What is it
> that you can accomplish having several group tags that is not possible
> having one group tag?
I am thinking of hte case where an image may belong to a group which
represents an environment, and another group which represetns "web
servers" which may cross environments.
Oh, I see what you are doing here. Permission bits are attached
to the group reference of an object (like in UNIX), but not to
entries in a group (as in an ACL). So if you want to have one that
reads (servers) and one that writes (users), you have to have two.
But if that's the case, you might want more than just two, eventually.
The maximum would be (2**n - 1) where n is number of permission bits
(e.g. a group for every access combination except the "no access").