[8072] in Kerberos
Re: beta7 kadmin related buglets
daemon@ATHENA.MIT.EDU (Barry Jaspan)
Fri Sep 20 12:44:38 1996
Date: Fri, 20 Sep 1996 12:20:02 -0400
From: "Barry Jaspan" <bjaspan@MIT.EDU>
To: mbeattie@sable.ox.ac.uk (Malcolm Beattie)
Cc: kerberos@MIT.EDU
In-Reply-To: [8070]
A buglet and a misfeature with beta7 kadmin stuff.
(1) With beta7 kadmin, "getprivs" always prints
current privileges: GET ADD MODIFY DELETE
getprivs is not supported in this release. It is known not to work.
It is not documented in the kadmin man page for this reason.
In OpenVision's initial implementation, kadmind permissions were
issued to specific principals for all targets (ie: if you have the
modify bit, you can modify any principal). In the current
implementation, permissions depend on the target of the operation (ie:
you might have modify permission on host/*, but nothing else). Thus,
getpriv's semantics make no sense with the current acl structure.
(2) kadmind needs restarting when the ACL file is changed. A SIGHUP
doesn't trigger a re-read, either.
This is not a bug, it is simply a potential feature that has not been
implemented. :-)
Barry
