Beefy Boxes and Bandwidth Generously Provided by pair Networks
Syntactic Confectionery Delight

Re: Bitmask or Named permissions

by blssu (Pilgrim)
on Oct 07, 2003 at 14:36 UTC ( #297300=note: print w/replies, xml ) Need Help??

in reply to Bitmask or Named permissions

I don't understand why the 64 bit limit is a problem. The bits are used to identify operations. The user id should be stored in another field.

There is no possible way your users will think about the security of 64 different operations. Maybe I'm missing something though. Could you list some of the "real" permissions instead of just the read/write/execute example?

I designed a security module that stores object permissions in an ACL table. Each different operation is given a column in the ACL table. If the value of the column is even, permission is denied; if the value is odd, permission is granted.

The data model looks like this:

ACL ( item_id integer, group_id integer, read_access integer, write_access integer, create_access integer, delete_access integer ... ) -- All objects with security assignments have -- an entry in the item table. Common attributes -- such as owner, creation date, data retention -- schedule, dispose-by date, etc. are stored -- here too. ITEM ( id integer, ... ) -- The session table is updated when a person -- logs in. Hierarchical group memberships are -- flattened out and inserted into the session -- table. SESSION ( user_id integer, group_id integer )

Each different object class can implement its own has_user_access method. The base class method does a simple ACL test using this query:

select max(read_access) from acl, session where acl.group_id = session.group_id and acl.item_id = :ITEM and session.user_id = :USER

The results of these security tests are cached only for the immediate operation (Apache request object). I use a bit-field, but since it is just a cache, the implementation can change without affecting any other code. After the operation is complete, the cache is thrown away so that security information can not leak between user sessions. (It is not as horrible as it sounds -- the database keeps its own cache so these checks rarely hit the disk.)

Log In?

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://297300]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others browsing the Monastery: (4)
As of 2021-10-17 00:08 GMT
Find Nodes?
    Voting Booth?
    My first memorable Perl project was:

    Results (70 votes). Check out past polls.