[Beaker-devel] Some thoughts on system access policies

Dan Callaghan dcallagh at redhat.com
Wed Jul 31 03:38:15 UTC 2013


Excerpts from Nick Coghlan's message of 2013-07-31 11:39:46 +1000:
> As part of this, I'm wondering if we want to borrow the *nix account
> management notion of creating an implicit group for each user, where
> they're the group owner and only member. Then we can require that access
> policies have an "owning group", and for user access policies, this
> would be the user's implicit group. Similarly, for custom access
> policies, the policy owner would be the system owner's implicit group. I
> suspect there are trade-offs either way (modelling user-owned policies +
> group-owned policies separately, or introducing an implicit group for
> each user), but it's something we should deliberately consider.

The other thing I forgot to say, related to this:

I think the answer here is not implicitly created/managed groups for 
each user, but instead to allow permissions in an access policy to be 
granted to individual users as well as groups.

This is a common capability in many ACL-type systems.

-- 
Dan Callaghan <dcallagh at redhat.com>
Software Engineer, Infrastructure Engineering and Development
Red Hat, Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/beaker-devel/attachments/20130731/68606df3/attachment.sig>


More information about the Beaker-devel mailing list