What pros and cons are there between access lists (Windows style) and user/group/others (UNIX style) for file permisions? reddit / BSD ---------------------------------------------------------------------- deojfj · 2020-10-13 06:49 Last week in class (UNIX administration) the professor mentioned that the way Windows manages file permissions (using access control lists) is more rich and flexible, compared to the way UNIX does it. The FreeBSD handbook mentions [support for ACLs](https://www.freebsd.org/doc/handbook/fs-acl.html), but it still keeps the UGO approach. The way I think of access lists is dropping the UGO concept and just give each file three parameters (read, write, and exec), each containing a list of users or groups, like this: read={ALL-user1-user2} write={NONE+group1-user3} exec={NONE} And when doing ls -l, it would need to check for each file if the current user has permission in each of the three actions: rw_ file1 These permissions would be independent of the owner of the file or its group. What pros and cons do you see between this approach and UGO? Are ACLs too complex? Thank you. ---------------------------------------------------------------------- lpsmith · 2020-10-13 12:37 Most popular filesystems on FreeBSD and Linux both support a flavor of ACLs, though they do typically have to be enabled. But usually, you can use ACLs on contemporary Unix systems if that's what you want/need. I am not sure that the UGO model is a particularly good simplification... although it can be made to meet the needs of many common situations. I would say that: 1. Both kind of suck, in that they are simultaneously too fine grained and also unable to express certain things. 2. They are mostly irrelevant in commonly used computing environments these days. Hosting multiple daemons on one machine seems to be headed towards BSD jails/Linux cgroups isolation, not the classical Unix multiuser isolation. Classical multiuser networking would be an exception, but with the growing ubiquity of webservices etc, that model of computing is increasingly niche (though it's also not clear it will ever go away completely) ---------------------------------------------------------------------- umlcat · 2020-10-13 12:56 Note: Several Unix based systems support access lists also. And, Windows did support file permissions. Original Unix style file permissions are native built in and doesn't require additional files as access files. ---------------------------------------------------------------------- lpsmith · 2020-10-13 13:59 Most Unix implementations of ACLs are natively built in and store ACLs in various kinds of extended attributes/metadata, not in separate access files. ---------------------------------------------------------------------- Garfield_M_Obama · 2020-10-13 19:16 It's a question of what you need. ACLs are inherently superior to unix permissions... when you need the granularity. But unix groups still exist and are the default because they solve many problems well, they just don't solve all problems of any complexity well (or at all in some cases). In a nutshell, you use unix groups and only worry about ACLs when you have a problem that obviously can benefit from ACLs. I don't see it as a theoretical question that has an interesting or useful answer, as far as I am concerned it's purely a question of having multiple tools in your tool belt and using a screwdriver to drive screws and a hammer to hammer nails. So the pros and cons are subjective and the only general statement that I think is true is that unix group permissions are simple, easy to work with, and powerful, but limited; whereas, ACLs tend to be more powerful but at the cost of a great deal of complexity in management and troubleshooting that can only be justified by the particular use case. ---------------------------------------------------------------------- shawn_webb · 2020-10-15 15:05 Note that UFS supports the same level of NFSv4 ACLs that ZFS enjoys. I use NFSv4 ACLs in nearly all my ZFS-based deployments.