[Gelistirici] Gruplar hakkında..

[S.Çağlar Onur]

11 Oca 2009 Paz tarihinde, Ozan Çağlayan şunları yazmıştı: 
> udev-136 NEWS dosyasından bir alıntı:
> 
> "In general, "normal" users who log into a machine should never be a member
> of any such group, but the device-access should be managed by dynamic ACLs,
> <http://git.kernel.org/?p=linux/hotplug/udev.git;a=blob;f=NEWS;h=d03de2f230e78df8fbda1e3614a786f8792fa525;hb=31a733070e2d324fbad4b3163b419626ef506cc6#l21>which get added and removed for the specific users on login/logout and
> session activity/inactivity. These groups are only provided for custom setups,
> <http://git.kernel.org/?p=linux/hotplug/udev.git;a=blob;f=NEWS;h=d03de2f230e78df8fbda1e3614a786f8792fa525;hb=31a733070e2d324fbad4b3163b419626ef506cc6#l23>and mainly system services, to allow proper privilege separation.
> <http://git.kernel.org/?p=linux/hotplug/udev.git;a=blob;f=NEWS;h=d03de2f230e78df8fbda1e3614a786f8792fa525;hb=31a733070e2d324fbad4b3163b419626ef506cc6#l24>A video-streaming daemon uid would be a member of "audio" and "video", to get
> <http://git.kernel.org/?p=linux/hotplug/udev.git;a=blob;f=NEWS;h=d03de2f230e78df8fbda1e3614a786f8792fa525;hb=31a733070e2d324fbad4b3163b419626ef506cc6#l25>access to the sound and video devices, but no "normal" user should ever belong
> <http://git.kernel.org/?p=linux/hotplug/udev.git;a=blob;f=NEWS;h=d03de2f230e78df8fbda1e3614a786f8792fa525;hb=31a733070e2d324fbad4b3163b419626ef506cc6#l26>to the "audio" group, because he could listen to the built-in microphone with
> <http://git.kernel.org/?p=linux/hotplug/udev.git;a=blob;f=NEWS;h=d03de2f230e78df8fbda1e3614a786f8792fa525;hb=31a733070e2d324fbad4b3163b419626ef506cc6#l27>any ssh-session established from the other side of the world."
> 
> dynamic ACL'den kasıt nedir, ACL ile bu işler nasıl yapılıyor, öyle mi 
> yapmalıyız acaba vs.vs.
> 
> Fikirler, yorumlar,
> 

Dinamik ACLleri uzunca zamandır (2007'den beri) kullanıyoruz zaten, diskleri user_xattr ile mount ediyor olmamızın sebebi de bu, HAL fdi dosyaları ile bunları dinamik olarak set ediyor, böylece mesela caglar kullanıcı ile login olduğun sistemde ozan kullanıcısına switch edince ses kartı caglar kullanıcısının sahipliğinde kalmıyor gibi hali hazırda aktif kullanımı da mevcut, bundan gayrisini okuyucuya bırakarak bkz PolicyKit, ConsoleKit, Dbus trio demek istiyorum :)

Shinigami ~ # getfacl /dev/dsp
getfacl: Removing leading '/' from absolute path names
# file: dev/dsp
# owner: root
# group: audio
user::rw-
user:caglar:rw-
group::rw-
mask::rw-
other::---
 

-- 
S.Çağlar Onur <caglar at pardus.org.tr>
http://cekirdek.pardus.org.tr/~caglar/

Linux is like living in a teepee. No Windows, no Gates and an Apache in house!
-------------- sonraki bölüm --------------
A non-text attachment was scrubbed...
Name: kullanılamıyor
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part.
URL: <http://liste.pardus.org.tr/gelistirici/attachments/20090111/a7b333e1/attachment-0002.pgp>