Hi to all.
I’m writing this post, because we have found a severe conflict between the ACL system and the standard way of handling group permissions in a unix box.
The standard way of handling file permissions in unix is to create groups of user, each group represents a role, the roles are jerarquized (i don’t know if this is right in english), ie:
General Manager
- Sales Manager
- Financial Manager
- IT Manager
Also a general group called users is used to simplify some permissions handling
Each user is assigned to a group in order to his main role in the organization
Each user is also assigned to the groups under his responsability ie:
The General Manager:
Primary Group = General Manager
Secondary Groups: IT Manager, Sales Manager, Financial Manager, IT Technicians, Salesman, Accounting, Credits, users
The IT Manager:
Primary Group = IT Manager
Secondary Groups = IT Technicians, users
The IT Technician
Primary Group = IT Technician
Secondary Groups = users
Thus when creating files, if a Technician creates a file, it belong to group IT Technicians. All the structure above him could read this file, because all has this group as a secondary group
But, if the IT Manager Creates a file (ie: an employee report), the IT Technician could not read it because this file belongs to group IT Managers, but the General Manager could read it, because it also belongs to this group.
This is how ACL should work.
ACL should grant the permissions looking only ant the primary group of the owner of the record.
ACL should check permissions against all groups (primary and secondary), from the user who are looking the record.
Thus you can set an ACL for the group IT Managers like this:
Group IT Managers (all, but private)
Group General Manager = Read
ACL for the Group IT Technicians:
Group IT Technicians (all, but private)
Group IT Managers = Read, Edit
Group General Manager = Read
With this setup you get a full control without conflict with the unix standards
In the actual setup you get that when a General Manager adds an entry it is automatically granted to all users because all users belongs to the users group!!!
And you cannot separate groups from eGroupware from system Groups because you use LDAP to unify the users and groups admimistration!!!
