[OpenAFS] Setting the setacl on newly created volumes
Charles Karney
ckarney@sarnoff.com
Fri, 20 Jul 2001 21:41:11 -0400 (EDT)
The ability of root on the AFS server to take certain privileged actions
greatly simplifies certain administrative functions (e.g., automating
backups) and means that system:administrators membership does not be be
given to as many users.
However one aspect of creating a new volume still requires
system:administrators membership and that is the initial setting of the
ACL. Thus
if root on server, then no AFS privs requird...
vos create server a user.jsmith -max 100000 -local
no "special" privs needed, just a+i access on parent directory...
fs mkm /afs/cell/u/jsmith user.jsmith
BUT THIS REQUIRES MEMBERSHIP OF system:administrators
fs sa /afs/cell/u/jsmith jsmith all
To get around this, I would propose one or both of the following extensions
to "vos create"
Allow an initial ACL to be specified when a volume is created, e.g.,
vos create server a user.jsmith -max 100000 -acl jsmith all -local
Alternatively let the owner be specified with
vos create server a user.jsmith -max 100000 -owner jsmith -local
By the way, the AFS documentation is coy about exactly what the "owner" (as
given by ls -ld) is all about.
I think the following is true:
* the owner has implicit "a" rights on a directory
* the only way to change the owner is to be BOTH Unix root AND a member of
system:administrators
* the owner of a file determines Unix privs when a setuid program is run in
a setuid cell.
It this right? Are there any other places that AFS uses the owner? Is
there an need for an entry in the /etc/passwd file?
Thanks.
--
Charles Karney Email: ckarney@sarnoff.com
Sarnoff Corporation Phone: +1 609 734 2312
Princeton, NJ 08543-5300 Fax: +1 609 734 2586