Subject: How do Mac access privileges map to Unix?

From: "Stan P. van de Burgt" <[email-masked]>
Date: Mon, 03 Jul 2000 21:58:11 +0200

Hi

Can anyone help me with a pointer to a document or a short desciption of
- the exact mapping of access privileges on a Mac vs those on Unix (Linux)
and vice versa?
- the inheritance of access privileges when copying files and folders  to a
shared disk.
- the inheritance of ownership of those files.

One of the things I'd like to have is a 'drop box' where a file can be
copied to, and where the owner of the drop box can pick it up.
But a complete overview would be great to set up the right privileges for a
shared network disk.

Thanx!

- Stan

--
Stan P. van de Burgt                 [email-masked] (0x853296C5)
DMO, P.O. box 1248, 3500 AE, Utrecht, the Netherlands

---

From: Tom Fitzgerald <[email-masked]>
Date: Mon, 03 Jul 2000 16:42:01 -0400

> - the inheritance of ownership of those files.

I was hoping someone else would answer authoritatively, but here's what 
I've
surmised from behavior:

- afpd processes run as the user who logged into the Mac, so the Mac has
  access to everything the user would ordinarily.  This is the only thing
  you need to decide if a user can *read* a file.

- Afpd gives newly-created directories the same permissions bits as those
  of the parent directory, including the setgid bit.

- Newly created files will get the same permissions bits as the parent
  directory, with the x bits stripped.

- Newly created files and directories will be owned by the creating user.
  If the parent directory has the setgid bit set, new files and directories
  will be in the same group as the parent; otherwise they will be in the
  creating user's primary group.  (This is normal Unix behavior.)

- Files and directories can only be created in directories to which the
  user has rwx access (as opposed to Unix, where only wx access is needed.)

- These rules apply to the .AppleDouble directories as well, but not to
  Network Trash Folder.

> But a complete overview would be great to set up the right privileges for a

I don't believe you can do this in general without letting all users
overwrite and delete files created in the dropbox by other users; you
can't have files created in the dropbox that can only be modified by the
creator and drop-box owner.

Now, if you're willing to create a subfolder for each user within the
dropbox, so that users can only drop files into their own folder, then you
can do it.

- Create a group "dropbox", whose only member is the owner of the dropbox

mkdir DropBox
chown owner DropBox
chmod 755 DropBox

- then for each user:

mkdir DropBox/user1
chown user1 DropBox/user1
chgrp dropbox DropBox/user1
chmod 775 DropBox/user1        (or maybe 770 to omit world readability)
chmod g+s DropBox/user1

...  and repeat for all other users.  In each subfolder, only two users
will be able to create or delete files, the owner of the dropbox subfolder
and the owner of the drop box itself.

Users should *not* cut/paste files into the dropbox or the permissions
will get screwed up.  Copy/pasting works okay, though.

---

From: Wilson Fletcher <wilsonf@[203.26.11.154]>
Date: Tue, 04 Jul 2000 14:00:22 +1000

Hi,

IST QUESTION: I've setup netatalk but I'm having some printer problems. The
printer (an HP IIP connected to the Server by the parallel port) seems to spit
the dummy with some of the font info. ie. errors are printed at the top of the
page and nothing else is diaplayed.

I got it printing from a G3 with OS 8.6 installed by deselecting all the options
for postscript in the page setup. But to get it print from ie 4.5 I had to set
the print options in IE to doanload any unknown fonts.

When both these changes were made the G3 seemed to be OK.

BUT, I have another Mac with 7.5.x and I couldn't get it to print.

I've included the contents of papd.conf below

2ND QUESTION: As mentioned above I setup the ljIIp and installed the ppd for the
IIp in the appropriate directory HOWEVER when setting up the Mac printer it
seemed to need it's own PPD file so I was wondering why I neded one on Linux.

Here is my papd.conf contents:

ljIIp:\
    :pr=lp0:\
    :op=root:\
    :pd=/usr/share/lib/ppd/HPIIP522.PPD

thanks,

Wilson

---

From: andrew morgan <[email-masked]>
Date: Mon, 3 Jul 2000 21:41:11 -0700 (PDT)

>     :pd=/usr/share/lib/ppd/HPIIP522.PPD

The PPD file in linux is used by papd to answer queries from the client
about the printer's capabilities, such as which fonts the printer has.  As
you found out, you still need to have the PPD on your mac as well.  I
don't think there is really much benefit to having the PPD on linux though
because you can set all the printer options on the client side anyways.

	Andy

---

From: "Stan P. van de Burgt" <[email-masked]>
Date: Tue, 04 Jul 2000 19:48:36 +0200

Thanks Tom,

It sure helps, although I hope more people will answer to this thread.
It would really help everyone to have the precise mapping semantics.

More below...

>   of the parent directory, including the setgid bit.

Is that the 't' shown when using ls -l ?

>   directory, with the x bits stripped.

Really??

>   user has rwx access (as opposed to Unix, where only wx access is needed.)

That explains my problems with creating a 'drop box' (see below).

>overwrite and delete files created in the dropbox by other users;

That's ok, as long as other users cannot see the file list
I think however that it is possible if you give it the same access rights 
as /tmp

>you

That's what I tried and it worked, although there seems to be something wrong.
With a +w setting, I get a nice 'folder with downarrow above it', but I 
other users cannot create files in it
With +wx the folder Icon is a normal one for other users but when they open 
it, they will see an empty folder (even if it's not) and see a small doc 
icon with red diagonal line across it

- Stan

---

From: Tom Fitzgerald <[email-masked]>
Date: Wed, 05 Jul 2000 21:12:56 -0400

> Is that the 't' shown when using ls -l ?

No, the 's' in the 7th column, in something like drwxrwsr-x or drwxrws---
 
The 't' is the sticky bit, which is appropriate for temporary
directories and such (it keeps users from deleting files created by
other users, but since it isn't inherited by subdirectories, it doesn't
help with dropboxes or any other kind of folder hierarchies).

> >   directory, with the x bits stripped.

Apparently....  in the source, ad_open intentionally sets the mode of
newly created files to the mode of the parent directory masked with the
bits the caller wants, and afp_createfile calls ad_open (.... 0666).  This
is what I've seen too.  (This is nearly always the right behavior.)

> icon with red diagonal line across it

I think you still need owner rwx access on all the subfolders, or users
can't create files in them.  The main dropbox folder needs to be rwxr-xr-x
(0755), and if you want to hide a user's dropbox from other users,
the subfolders need to be rwxrws--- (mode 0770 with the setuid bit, which
is actually 02770).  I assume there's no problem with users seeing the
files they've created themselves.