Not logged in
Log in now
Create an account
Subscribe to LWN
LWN.net Weekly Edition for May 23, 2013
An "enum" for Python 3
An unexpected perf feature
LWN.net Weekly Edition for May 16, 2013
A look at the PyPy 2.0 release
every time apache has to access a file it needs to look in .htaccess for that directory, AND EVERY PARENT DIRECTORY.
As a result, just about every production apache server disables .htaccess files.
Ghosts of Unix past, part 3: Unfixable designs
Posted Nov 16, 2010 20:47 UTC (Tue) by alvieboy (subscriber, #51617)
But Apache is not only meant for Linux. Other OSes do not provide these functionalities.
What's really harder is to apply all constraints in a fast and efficient way. I never benchmarked Apache on this, but I'd bet its not that fast nor efficient.
Posted Nov 16, 2010 21:21 UTC (Tue) by dlang (✭ supporter ✭, #313)
so yes, they are horribly inefficient
in terms of caching the combined contraints, that seems hard in the face of directories being moved around.
there's also the issue of the interaction with links and finguring out the 'true' path to a file.
Posted Nov 17, 2010 1:55 UTC (Wed) by buck (subscriber, #55985)
i'll concede that maybe AFS directory-only permissions might simplify
things a bit, at the fringes
Posted Nov 17, 2010 2:50 UTC (Wed) by dlang (✭ supporter ✭, #313)
Posted Nov 17, 2010 9:53 UTC (Wed) by iq-0 (subscriber, #36655)
It even has a good chance to be cheaper than the current unix model, since in a practical setup there would only be a few (compiled) rulesets in effect (still hundreds, but a lot less than actual dentries). One could possibly cache a pointer to the list of effective rules to a dentry/inode (depending on how the rules are to be applied, this is semantics, but I suspect you'd want them on the inode level).
But the decoupling of the details from every single inode can probably be done without any real performance impact (and possibly even performance gains). Whether you use hierarchical ACLs or matching rules shouldn't really make a difference and constant tree traversals shouldn't be necessary when done at the VFS level.
Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds