On 07/31/2013 01:38 PM, Dan Callaghan wrote:
Excerpts from Nick Coghlan's message of 2013-07-31 11:39:46
+1000:
> As part of this, I'm wondering if we want to borrow the *nix account
> management notion of creating an implicit group for each user, where
> they're the group owner and only member. Then we can require that access
> policies have an "owning group", and for user access policies, this
> would be the user's implicit group. Similarly, for custom access
> policies, the policy owner would be the system owner's implicit group. I
> suspect there are trade-offs either way (modelling user-owned policies +
> group-owned policies separately, or introducing an implicit group for
> each user), but it's something we should deliberately consider.
The other thing I forgot to say, related to this:
I think the answer here is not implicitly created/managed groups for
each user, but instead to allow permissions in an access policy to be
granted to individual users as well as groups.
This is a common capability in many ACL-type systems.
Agreed.
Cheers,
Nick.
--
Nick Coghlan
Red Hat Infrastructure Engineering & Development, Brisbane
Testing Solutions Team Lead
Beaker Development Lead (
http://beaker-project.org/)