/[docman2]/doc/trustee.html
This is repository of my old source code which isn't updated any more. Go to git.rot13.org for current projects!
ViewVC logotype

Diff of /doc/trustee.html

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.1 by dpavlin, Sun Jul 21 13:25:15 2002 UTC revision 1.6 by dpavlin, Mon Jul 29 10:29:05 2002 UTC
# Line 5  concept of trustees for Linux kernel by Line 5  concept of trustees for Linux kernel by
5  <zavadsky@braysystems.com>  <zavadsky@braysystems.com>
6  </p>  </p>
7    
8  <p>Trustiees are used to controll access right, and special fetures  <p>Trustees are used to control access right, and special features
9  (like notify on change)  (like <a href="notify.html">notify on change</a>)
10  </p>  </p>
11    
12  <h2>Format of trustee file</h2>  <h2>Format of trustee file</h2>
# Line 14  concept of trustees for Linux kernel by Line 14  concept of trustees for Linux kernel by
14  <p>Comments are written using hash (#) as first character in line  <p>Comments are written using hash (#) as first character in line
15  <br><tt># this is a comment</tt></p>  <br><tt># this is a comment</tt></p>
16    
17  <p>Group can be used instead of username in all ACLs. You can't have user  <p>Group can be used instead of user-name in all ACL. You can't have user
18  which has same name as group or vice-versa. It's written using plus (+) as  which has same name as group or vice-versa. It's written using plus (+) as
19  first character in line.  first character in line.
20  <br>+<i>group</i>:<i>user</i>[,<i>user</i>...]</p>  <br>+<i>group</i>:<i>user</i>[,<i>user</i>...]</p>
# Line 25  first character in line. Line 25  first character in line.
25  Valid modifiers:  Valid modifiers:
26  <ul>  <ul>
27  <li><tt>!</tt> trustee applies to all except user or group  <li><tt>!</tt> trustee applies to all except user or group
28  <li><tt>C</tt> clear the persmission (default is to set)  <li><tt>C</tt> clear the permission (default is to set)
29  <li><tt>D</tt> deny access (default is grant)  <li><tt>D</tt> deny access (default is grant)
30    <li><tt>O</tt> one-level trustee only <small>(this means that those permissions
31            will not be inherited on directories and files downwards from current
32            level -- it's useful for <a href="#anonymous">anonymous access</a>)
33            </small>
34  </ul>  </ul>
35    
36  Valid permissions:  Valid permissions:
# Line 34  Valid permissions: Line 38  Valid permissions:
38  <li><tt>R</tt> read (file)  <li><tt>R</tt> read (file)
39  <li><tt>W</tt> write (file)  <li><tt>W</tt> write (file)
40  <li><tt>B</tt> browse (directory)  <li><tt>B</tt> browse (directory)
41  <li><tt>N</tt> notify (e-mail change)  <li><tt>N</tt> <a href="notify.html">notify</a> (e-mail change)
42  </ul>  </ul>
43    
44  <h2>Examples</h2>  <h2>Examples</h2>
45    
46  <pre>  <pre>
47  # dpavlin is admin (grant all access to members of root group)  # dpavlin is administrator (grant all access to members of root group)
48  +root:dpavlin  +root:dpavlin
49  /:root:RWB  /:root:RWB
50  # give read-only access to all users  # give read-only access to all users
# Line 59  read-only access) you could write: Line 63  read-only access) you could write:
63  /secret.txt:*:DRWB:joe:R  /secret.txt:*:DRWB:joe:R
64  </pre>  </pre>
65    
66  That is wrong. <b>deny</b> rules will take precedance over allow read  That is wrong. <b>deny</b> rules will take precedence over allow read
67  to joe. So, you should write:  to joe. So, you should write:
68    
69  <pre>  <pre>
# Line 68  to joe. So, you should write: Line 72  to joe. So, you should write:
72    
73  Which will work.  Which will work.
74    
75  <big>FIX</big> write more examples, beter descriptions...  <big>FIX</big> write more examples, better descriptions...
76    
77    <a name="anonymous">
78    <h3>Anonymous access</h3>
79    
80    <p>One of great advantages of using trustees is that you can allow
81    anonymous access (without login). You should pay attention to access
82    right, because you probably don't want anonymous users to see all files
83    or folders in your repository.
84    </p>
85    
86    <p>First, you will have to add browse trustee to anonymous user
87    on root directory -- docman will ignore all anonymous users if
88    you don't do this.
89    <pre>
90            /:anonymous:BO
91    </pre>
92    You really <b>want to use flags <tt>BO</tt></b> and not just <tt>B</tt> because
93    if you specify just <tt>B</tt> anonymous users will be able to browse (see
94    directory names) of your whole repository. This way you can explicitly
95    allow (or deny) which sub-directories you want anonymous users to browse.
96    <br>For example, this will allow anonymous users to see and read everything
97    in <tt>/pub</tt> and to store documents in <tt>/incoming</tt>:
98    <pre>
99            /pub:anonymous:RB
100            /incoming:anonymous:RWB
101    </pre>
102    You might also want to hide some directory from anonymous users, and you
103    can do that using:
104    <pre>
105            /private:anonymous:DB
106    </pre>
107    If you would like to <b>give all your users</b> which are authetificated via
108    login and password <b>all access</b> to all files (like in old docman v1.x) you
109    also have to add
110    <pre>
111            /:*:RWB
112    </pre>
113    However, that <b>will not add all
114    permission to anonymous users</b>. If you want to add all that permission
115    to anonymous users (which will create wiki-like comunity for sharing files)
116    you must explicitly say that you allow that to anonymous users:
117    <pre>
118            /:anonymous:RWB
119    </pre>
120    All those setting will create enviroment which is very like docman v1.x,
121    but with anonymous users allowed to see document in <tt>/pub</tt> and
122    upload them in <tt>/incoming</tt>.
123    </p>
124    
125  <h2>Default security</h2>  <h2>Default security</h2>
126    
# Line 81  users) Line 133  users)
133  <h2>docman without trustee configuration</h2>  <h2>docman without trustee configuration</h2>
134    
135  <p>If you <b>don't have</b> <tt>realm/http_virtual_host.trustee</tt> you  <p>If you <b>don't have</b> <tt>realm/http_virtual_host.trustee</tt> you
136  will fall-back to default docman v1.x behaviour: whole group will have  will fall-back to default docman v1.x behavior: whole group will have
137  all right on all files except <i>anonymous</i> users (which won't be able  all right on all files except <i>anonymous</i> users (which won't be able
138  to login anyway).  to login anyway).
139  </p>  </p>
140    
141    <p>See also:
142    <a href="admin.html">Administration manual</a>
143    </p>
Legend:
Removed from v.1.1  
changed lines
  Added in v.1.6
  ViewVC Help
Powered by ViewVC 1.1.26