System components
2.4 Filesystems
2.4.3 Network filesystem models
The result is shown in the last line. If, instead of replacing the ACE, we want to supplement it, we write
hybrid> CACLS testfile /E /G mark:R {\var wait for 30 seconds}
Are you sure(Y/N)?
hybrid> CACLS testfile
C:\home\mark\testfile HYBRID\ds:F HYBRID\mark:R
New files: inheritance
Although the technical details of the NTFS and its masking schemes are not well documented, we can note a few things about the inheritance of permissions. In the absence of any ACL settings on a parent directory, a new file is created, granting all rights to all users. If the parent directory has an ACL, then a new file inherits that ACL at the time of its creation. When a file is moved, it keeps its NTFS permissions, but when a file is copied, the copy behaves like a new file, inheriting the attributes of its new location.
Flag Rights acquired by named user, group, other in ACL r Ability of open and read a file or
directory contents.
w Ability to open and write to a file or to add files to a directory.
x Ability to execute files as programs or enter directories.
d Ability to erase (delete) a file or directory.
c Ability to modify file attributes including rename.
i Ability to add files to a directory.
Table 2.4:DFS permissions. New files inherit the initial object ACL of their parent directory.
These flags can be applied to named lists of users, or groups or others, in the Unix sense.
amounts of experimental data with colleagues all over the world. The local network domain model of NFS was not sufficient for this task. AFS has an Access Control List (ACL) model, thus improving on Unix file security. A further improvement came with the Distributed Computing Environment (DCE) filesystem DFS, that provided further enhancements and a sanitized ACL model (see table 2.5).
AFS and DFS have been embraced widely in this context, allowing collabora-tors in Japan, Europe and the United States to be connected simply by changing directory to a new country, organization and site (see section 3.8.7). These filesys-tems also employ Access Control Lists, based on, but not limited by, the Unix permission model (see table 2.4). AFS now has an OpenAFS implementation.
Note that the DCE/DFS filesystem is not related to Windows’s DFS filesystem, though the idea is similar.
As we can see, many of these file systems have drawn on the pioneering ideas of experimental filesystems. Today, most filesystems work in a similar way, with Unix lagging behind in sophistication, but not in functionality. Ironically, for all the flexibility that ACLs offer, they have proved to be confusing and difficult to understand and the extra functionality they provide is dwarfed by the feeling of dread which they instill in administrators and users alike. On systems with only ACLs, file permissions tend to be set inappropriately more often than on Unix-like systems. Unix’s simpler approach, while basically old and simplistic, is a more palatable and manageable alternative for all but the most sophisticated users.
Another major filesystem, in a similar vein, is the Novell Netware filesys-tem. This is an interesting filesystem which can also create a seamless file tree called the Novell Directory Service (NDS) within an organization. Here files
Flag Rights acquired by named user, group in ACL r Ability of open and read a file or
directory contents.
l Lookup within a directory.
w Ability to open and write to a file.
i Ability to insert files in directories.
d Ability to erase (delete) a file or directory.
a Ability to modify file attributes including rename.
k Lock files.
Table 2.5: AFS permissions. These flags can be applied to named lists of users, or groups but not ‘others’. Four shorthand forms also exist write=rlidwk, read=rl, all=rlidwka, and none removes an entry.
have an owner and an Access Control List, which can grant or restrict access to named users or groups. The Windows model was presumably inspired by this. The Netware idea is not unlike NFS or DFS in attempting to integrate organizations’ disks into a communal file tree, but the user interface is supe-rior, since it is not limited by compatibility issues. However Netware forces a particular object-oriented interpretation of the network onto disks, whereas NFS does not care about the file tree structure of hosts which incorporate shared filesystems. With NFS, hosts do not have to subscribe to a global vision of shared network resources, they simply take what they want and main-tain their own private file tree: each host could be kept quite different. Oddly enough, Windows did not embrace the model of seamless sharing, choosing instead to mount drives on the old DOS drive letters A:, B: etc, though it is likely that such seamless integration will come in a future version. Novell too has to deal with this antiquity, since it serves primarily Windows based machines.
While Solaris’ NFS does support its own brand of Access Control Lists, NFS cannot be used to provide inter-platform ACL functionality. Netware does support its own state of the art filesystem attributes, based on the usual object inheritance model of directories as containers for smaller containers. Each file has an owner and an ACL (see table 2.6).
The Common Internet File System (CIFS), based on Microsoft’s Server Message Block (SMB) protocols sets is yet another popular way of sharing files. Windows software and Unix’s Samba software bind together hosts using this form of Remote Procedure Call (see section 9.10).
Flag Rights acquired by named user in ACL S Supervisor rights grant all rights to
a file, directory and all subdirectories.
R Ability of open and read a file or directory contents.
W Ability to open and write to a file or to add files to a directory.
C Ability to create new files and undelete old ones, or create new directories.
E Ability to erase (delete) a file or directory.
M Ability to modify file attributes including rename.
F Ability to see files within a directory when viewing contents.
A Ability to change access rights on file or directory, including granting others access rights. Also change inheritance masks for directories.
Table 2.6:Netware 5 permissions. New file objects inherit the default permissions of their container, minus any flags in the Inherited Rights Filter/Mask (IRF). Permissions can be applied to named users or groups.