The trouble with dropping groups

Posted Nov 20, 2014 11:17 UTC (Thu) by smurf (subscriber, #17840)
Parent article: The trouble with dropping groups

I'd solve that with two group lists. You use one for granting access and the other for denying it. The latter must of course be a superset of the former, which is the only one the process itself can modify.