[OpenAFS] Re: possibly stupid question: why can't AFS serve "normal" directories like samba/nfs?

[Jeffrey Hutzelman]

On Tuesday, October 11, 2005 11:15:30 AM -0700 Adam Megacz 
<megacz@cs.berkeley.edu> wrote:

>
> Jeffrey Hutzelman <jhutz@cmu.edu> writes:
>> thing. It does some pretty hideous things to get something approaching
>> reasonable security semantics, given the assumptions people make about
>> how access controls work on UNIX filesystems.
>
> Could you elaborate on this?  My understanding was that it simply
> didn't bother to support security (all files are read-only,
> world-readable)

Not at all true.  It maps users' credentials onto a local uid based on 
passwd file and .klogin lookups (it is possible to request a specific 
username using a hostafs-specific client utility, but this is still subject 
to a .klogin check).  It then simulates ACL's and performs access checks 
based on the user's identity and the owner and mode bits of the files being 
accessed (no, it doesn't use access(2); this was a proof-of-concept and 
that would have been more work since we'd have had to map unix modes onto 
AFS access rights anyway).  For users who don't have accounts on the 
server, it can be configured to provide different sets of rights to 
local-realm, foreign-realm, and unauthenticated users, again based on the 
mode bits (at present, the place that would look up this configuration just 
hard-codes the results instead, but it's easy to change).


Perhaps you're thinking of tafssrv, a trivial fileserver I wrote more 
recently for the purpose of exporting small amounts of relatively-static 
content.