[rsbac] ACLs and Samba

[Alexander E. Cuttergo]

On Tuesday, 29 Apr 2003 16:26:33 +0200, Amot Ott wrote:
>> Ok. As I understand the standard Unix users and special ACL groups
>> can be subjects for ACLs but not the standard Unix groups. Is that
>> correct and what is the reason for this?
>
> It is correct.
>
> The reason is that the standard Unix group administration is insecure: It
> usually only depends on an uncontrolled editing of a file (/etc/group), and
> the superuser root can assign any group to a process.
Wait a second.
If "uids administration" is to be secure, then it must not "depends on an
uncontrolled editing of a file", /etc/passwd and /etc/shadow in this case. If 
RSBAC provides workarounds against modifying /etc/passwd (or any other user
database), then the same tricks can be used to protect /etc/group, correct ?
If it is not done yet, it is an effect of lack of time, I guess.

> Additionally, the ACL groups can be private or global, each user can have an
> individual set of them and there is no limit on the number of groups a user
> can be in at the same time.
Sorry, I don't get it. How the above sentence relates to infeasibility of
providing ACLs for Unix groups ?

peace,
Algo