Re: [RFC v6 08/40] richacl: Compute maximum file masks from an acl

2015-09-02 21:54 GMT+02:00 J. Bruce Fields [off-list ref]:

quoted

+     richacl_for_each_entry_reverse(ace, acl) {
+             if (richace_is_inherit_only(ace))
+                     continue;
+
+             if (richace_is_owner(ace) ||
+                 (richace_is_unix_user(ace) &&
+                  uid_eq(ace->e_id.uid, owner))) {
+                     if (richace_is_allow(ace))
+                             acl->a_owner_mask |= ace->e_mask;
+                     else if (richace_is_deny(ace))
+                             acl->a_owner_mask &= ~ace->e_mask;
+             } else if (richace_is_everyone(ace)) {
+                     if (richace_is_allow(ace)) {
+                             acl->a_owner_mask |= ace->e_mask;
+                             acl->a_group_mask |= ace->e_mask & gmask;
+                             acl->a_other_mask |= ace->e_mask;
+                     } else if (richace_is_deny(ace)) {
+                             acl->a_owner_mask &= ~ace->e_mask;
+                             acl->a_group_mask &= ~ace->e_mask;
+                             acl->a_other_mask &= ~ace->e_mask;
+                     }
+             } else {
+                     if (richace_is_allow(ace)) {
+                             acl->a_owner_mask |= ace->e_mask & gmask;
+                             acl->a_group_mask |= ace->e_mask & gmask;

I think we do that because we don't (we can't) know whether the owner
might match this ace, so we assume that it will match, as that's what
gives us the maximum.

Yes.

But on first glance this is a little counterintuitive and maybe worth a
comment.

I agree.

Thanks,
Andreas