Problems with capabilities

I will need to read NYKevin's paper, and maybe I am being simplistic, but I fail to see why it needs to be complex.

Personally I would "set_acl DEFAULT:LUR". Gives you permission to cd into the directory (Use), see what's in it (List), and Read any files in it. Absent any good reason, I think blocking people out (a) does more harm than good, and (b) if people *can* read it, they're actually *less* likely to want to.

Unfortunately there's plenty of good reasons for DEFAULT:$NONE, starting with GDPR and going downhill from there.

If you work in a department, you need department permissions. These should be additive, so you are in several groups. If you're working on a project, you need project permissions, so you're in other groups. I don't see why, in a properly designed setup, you would need to take permissions away? You need department permissions, you need project permissions, you can only be logged in to one project at a time, so you can't transfer stuff between projects unless their permissions intersect ...

And then for the assholes, you have $USER:$NONE. You've given them an explicit set of permissions, and that trumps everything else.

NYKevin's paper (from my first glance) goes into a lot of stuff about how certain objects need permission to access other stuff, but from what I could see it all seems to be additive.

Under my scheme, there's no need to "take away" rights. If you work on the basis that named people get the rights they are given under their named user and that's it, you have control at the individual level. You then work on the basis that normal people need rights based on their permanent job, and their temporary role, and they get assigned additive group permissions based on that. And lastly, if you are not given personal or group rights, you get the default.

There is no mechanism there for negative rights. And I can't see why you'd need it. For the odd occasion where assigning rights to either a person's job, or role, doesn't cut it you just assign the necessary rights to the person.

The paper goes on about how an *object* (a shared document, say) needs to access other objects to display properly, but my immediate reaction to that is SHOULD one document be allowed to access another? What happens if I share a document that is not itself sensitive, but contains links to sensitive data? Just because I can see the entire document, doesn't mean that I should be able to share it with someone else, and leak that sensitive data to someone who's not supposed to see it! I can understand why that might be important to Google, but it stinks to me of Facebook's habit of deliberately "failing open".

I've no doubt people can come up with contrived examples, but I have difficulty conceiving of a scenario where, if your necessary access rights are properly designed and allocated, you then need subtractive rights to be able to take permissions away from people. And as soon as you fail to come up with a reasonably-to-be-encountered scenario where you have to take rights away, ACLs become pretty simple. (And no, I haven't yet studied the paper.)

Cheers,
Wol