继承访问控制条目还是完整的访问控制列表 (ACL)？
我想知道是否应该继承完整的 ACL 还是仅继承其访问控制条目 (ACE)。
如果孩子们替换整个 ACL 会很简单，但如果只添加一个额外的 ACE 就会受到限制。
如果ACE可以继承，我想我需要负权限，因为否则从根ACL开始的所有权限都会被累积。正确的？
ACE 继承和消极权利会增加很多灵活性，但也可能导致难以理解的安全限制。一方面我想避免负面权利，但另一方面，系统可能会因为它们的缺失而变得难以维护（通过不必要的 ACL 重复）。
那么该怎么办呢？仅继承完整的 ACL 还是继承 ACE？添加或不添加负面权限？
临时解决方案：由于没有人有想法，我决定在访问控制条目的基础上使用继承。执行此操作不需要负权限，但我将实现它们以实现更大的灵活性。
I wonder if complete ACLs or only their Access Control Entries (ACE) should be inherited.
It would be simple if the children replace the whole ACL, but it would be limitting if only an additional ACE should be added.
If ACEs can be inherited, I think I would need negative rights, because otherwise all rights beginning from the root ACL would be accumulated. Right?
ACE inheritance and negative rights would add a lot flexiblity but could also lead to hard to understand security restrictions. I'd like to avoid negative right on the one hand, but on the other hand a system could become hard to maintain because of their absence (through otherwise needless duplication of ACLs).
So what to do? Inherit only complete ACLs or inherit ACEs? Add negative permissions or not?
Provisional Solution: Since nobody had an idea, I decided to use inheritance on access control entry basis. Negative permissions wouldn't be required to do this, but I'll implement them to achieve greater flexiblity.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论