2015-06-25 23:40 GMT+02:00 Stefan (metze) Metzmacher [off-list ref]:

quoted

quoted

I'm wondering if the size of an ace should be dynamic,
which might make it possible to support other ace types
in future. E.g. supporting other identities like 128-bit values
to make it easier to map Windows SIDS.

I'm working on additionally supporting unmapped user@domain and
group@domain identifier strings; we have to deal with that case in the
nfs client; that may be useful for Samba as well.

Can this be any string? So would
"S-1-5-21-4052121579-2079768045-1474639452-1001" also work?

I don't see why not, we'd just need to prevent namespace clashes.

How would the current thread/process get a "token" that would match such
an ace?

Solaris seems to solve this by what they call ephemeral ids; that concept may
become useful.

[...]
In general shouldn't kuid_t uid = current_fsuid(); be at the top of the
function just once?

It really is just a pointer dereference.

Thanks,
Andreas