Basic File Privileges [PSARC/2009/378 FastTrack timeout 7/10/2009]

[Nicolas Williams]

On Fri, Jul 03, 2009 at 05:45:14AM -0700, Casper Dik wrote:
> This project proposes two new "basic" privileges.
> 
> FILE_READ
>         Allows a process to read a file or directory whose
>         permission or ACL allow the process read permission.
> 
> FILE_WRITE
>         Allows a process to write a file or directory whose
>         permission or ACL allow the process write permission.

Does not having basic file privileges affect a process' ability to
receive, via IPC, open file descriptors with contrary access?

It might be useful to have a way to grant a process read and/or write
access to specific objects while still denying it the right to do so in
general.  The simplest way to do that that I can imagine is by adding an
additional pair of basic file privileges that apply only to files in the
current directory (not following symlinks) and, perhaps, below.

Nico
--