| ▲ | 7bit a day ago |
| And behind on a lot of stuff. The Microsoft's ACLs are nothing short of one of the best designed permission systems there are. On the surface, they are as simple as Linux UOG/rwx stuff if you want it to be, but you can really, REALLY dive into the technology and apply super specific permissions. |
|
| ▲ | nunez a day ago | parent | next [-] |
| The file permission system on Windows allows for super granular permissions, yes; administrating those permissions was a massive pain, especially on Windows file servers. |
|
| ▲ | torginus a day ago | parent | prev | next [-] |
| And they work on everything. You can have a mutex, a window handle or a process protected by ACL. |
|
| ▲ | jandrese a day ago | parent | prev | next [-] |
| > The Microsoft's ACLs are nothing short of one of the best designed permission systems there are. You have a hardened Windows 11 system. A critical application was brought forward from a Windows 10 box but it failed, probably a permissions issue somewhere. Debug it and get it working. You can not try to pass this off to the vendor, it is on you to fix it. Go. |
| |
| ▲ | fooker 20 hours ago | parent | next [-] | | Is this a trick question, because you run it as administrator in a sandboxed account. | |
| ▲ | 7bit a day ago | parent | prev | next [-] | | Procmon.exe. Give me 2 minutes. You make it sound like it's such a difficult thing to do. It literally will not take me more than 2 minutes to tell you exactly where the permission issue is and how to fix it. | | |
| ▲ | roblabla a day ago | parent [-] | | Procmon won't show you every type of resource access. Even when it does, it won't tell you which entity in the resource chain caused the issue. And then you get security product who have the fun idea of removing privileges when a program creates a handle (I'm not joking, that's a thing some products do). So when you open a file with write access, and then try to write to the file, you end up with permission errors durig the write (and not the open) and end up debugging for hours on end only to discover that some shitty security product is doing stupid stuff... Granted, thats not related to ACLs. But for every OK idea microsoft had, they have dozen of terrible ideas that make the whole system horrible. | | |
| ▲ | jandrese a day ago | parent | next [-] | | Especially when the permission issue is up the chain from the application. Sure it is allowed to access that subkey, but not the great great grandparent key. | |
| ▲ | lmz 12 hours ago | parent | prev | next [-] | | Shitty security products being inscrutable isn't limited to Windows. "Disable SELinux" anyone? | |
| ▲ | 7bit 17 hours ago | parent | prev [-] | | At this point you're just arguing for the sake of bashing on Microsoft. You said it yourself, that's not related to ACL, so what are you doing, mate? This is not healthy foundation for a constructive discussion. |
|
| |
| ▲ | butlike a day ago | parent | prev [-] | | and why is it not on the vendor of the critical application? | | |
| ▲ | jandrese a day ago | parent [-] | | Because they aren't allowed on the system where it is installed, and also they don't deal with hardened systems. |
|
|
|
| ▲ | Eggpants 7 hours ago | parent | prev | next [-] |
| And yet, it requires kernel extension anti-cheat to stop a game mod from reading and writing memory locations in a running process. It’s a toy operating system if it can’t even prevent that. It’s why corporate machines are so locked down. Then there is the fact video drivers run in ring 0 and are allowed to phone home… but hey you can prevent notepad++ from running FTW. |
|
| ▲ | bbkane a day ago | parent | prev | next [-] |
| Do you have any favorite docs or blogs on these? Reading about one of the best designed permissions systems sounds like a fun way to spend an afternoon ;) |
|
| ▲ | trueismywork a day ago | parent | prev | next [-] |
| You have ACLs on linux too |
| |
| ▲ | Arainach a day ago | parent | next [-] | | ACLs in Linux were tacked on later; not everything supports them properly. They were built into Windows NT from the start and are used consistently across kernel and userspace, making them far more useful in practice. Also, as far as I know Linux doesn't support DENY ACLs, which Windows does. | | |
| ▲ | onraglanroad a day ago | parent [-] | | Yes it does. | | |
| ▲ | 112233 a day ago | parent [-] | | since when? | | |
| ▲ | onraglanroad a day ago | parent [-] | | Since some of us could be bothered reading docs. Give it a try and see how it works out for you. | | |
| ▲ | 112233 a day ago | parent [-] | | Some of us can! I certainly enjoy doing it, and according to "man 5 acl" what you assert is completely false. Unless you have a particular commit or document from kernel.org you had in mind? | | |
| ▲ | opello a day ago | parent [-] | | > Each of these characters is replaced by the - character to denote that a permission is absent in the ACL entry. Wouldn't the o::--- default ACL, like mode o-rwx, deny others access in the way you're describing? | | |
| ▲ | 112233 18 hours ago | parent [-] | | See 6.2.1 of RFC8881, where NFSv4 ACLs are described. They are quite similar to Windows ACLs. Here is kernel dev telling they are against adding NFSv4 ACL implementation. The relevant RichAcls patch never got merged: https://lkml.org/lkml/2016/3/15/52 | | |
|
|
|
|
|
| |
| ▲ | a day ago | parent | prev | next [-] | | [deleted] | |
| ▲ | 112233 a day ago | parent | prev | next [-] | | Haha, sure. Sorry, it's not you, it's the ACLs (and me nerves). Have you tried configuring NFSv4 ACLs on Linux? Because kernel devs are against supporting them, you either use some other OS or have all sorts of "fun". Also, not to be confused with all sorts of LSM based ACLs... Linux has ACLs in the most ridiculous way imaginable... | |
| ▲ | 7bit a day ago | parent | prev [-] | | Not by default.
Not as extensive as in Windows.
What's your point? |
|
|
| ▲ | dabockster a day ago | parent | prev [-] |
| Oh yeah for sure. Linux is amazing in a computer science sense, but it still can't beat Windows' vertically integrated registry/GPO based permissions system. Group/Local Policy especially, since it's effectively a zero coding required system. Ubuntu just recently got a way to automate its installer (recently being during covid). I think you can do the same on RHEL too. But that's largely it on Linux right now. If you need to admin 10,000+ computers, Windows is still the king. |
| |
| ▲ | Elv13 a day ago | parent | next [-] | | Debian (and thus Ubuntu) has full support for automated installs since the 90's. It's built into `dpkg` since forever. That include saving or generating answer to install time questions, PXE deployment, ghosting, CloudInit and everything. Then stuff like Ansible/Puppet have been automating deployment for a long time too. They might have added yet another way of doing it, but full stack deployment automation has been there for as long as Ubuntu existed. | |
| ▲ | cactacea a day ago | parent | prev | next [-] | | > Ubuntu just recently got a way to automate its installer (recently being during covid). Preseed is not new at all: https://wiki.debian.org/DebianInstaller/Preseed RH has also had kickstart since basically forever now. I've been using both preseeds and kickstart professionally for over a decade. Maybe you're thinking of the graphical installer? | |
| ▲ | benterix a day ago | parent | prev | next [-] | | > Ubuntu just recently got a way to automate its installer (recently being during covid). I think you can do the same on RHEL too. But that's largely it on Linux right now. If you need to admin 10,000+ computers, Windows is still the king. What?! I was doing kickstart on Red Hat (want called Enterprise Linux back then) at my job 25 years ago, I believe we were using floppies for that. | | |
| ▲ | m4rtink a day ago | parent [-] | | Yeah, I have been working on the RHEL and Fedora installer since 2013 and already back then it had a long history almost lost to time - the git history goes all the way back to 1999 (the history was imported from CVS, as it predates Git) and that actually only cover the first graphical interface - it had automated installation support via kickstart and a text interface long before that, but the commit history has been apparently lost. And there seems to have been even some earlier distict installer before Anaconda, that likely also supported some sort of automated install. BTW, we managed to get the earlies history of the project written down here by one of the earliest contributors for anyone who might be interested: https://anaconda-installer.readthedocs.io/en/latest/intro.ht... As for how the automated installation on RHEL, Fedora and related distros works - it is indeed via kickstart: https://pykickstart.readthedocs.io/en/latest/ Note how some commands were introduced way back in the single digit Fedora/Fedora Core age - that was from about 2003 to 2008. Latest Fedora is Fedora 43. :) |
| |
| ▲ | LeSaucy a day ago | parent | prev | next [-] | | Still the king but developing/testing/debugging group policy issues is a miserable experience. | | |
| ▲ | bigstrat2003 21 hours ago | parent | next [-] | | I disagree. Group policies are extremely straightforward to administer in my experience. | | |
| ▲ | UltraSane 15 hours ago | parent [-] | | That depends on how fine grained your targeting rules are. They can get insane. |
| |
| ▲ | 7bit a day ago | parent | prev [-] | | I always found it straight forward. Never had an issue and I've implemented my fair share on thousands on devices and servers. | | |
| ▲ | lll-o-lll a day ago | parent [-] | | Not an implementer of group policy, more of a consumer. There are 2 things that I find extremely problematic about them in practice. - There does not seem to be a way to determine which machines in the fleet have successfully applied. If you need a policy to be active before doing deployment of something (via a different method), or things break, what do you do? - I’ve had far too many major incidents that were the result of unexpected interactions between group policy and production deployments. | | |
| ▲ | 7bit 17 hours ago | parent [-] | | That's not a problem with group policy. You're just complaining that GPO is not omnipotent. That's out of scope for group policies mate. You win, yeah yeah.... Bye |
|
|
| |
| ▲ | esseph a day ago | parent | prev | next [-] | | > Ubuntu just recently got a way to automate its installer (recently being during covid). I think you can do the same on RHEL too. But that's largely it on Linux right now. If you need to admin 10,000+ computers, Windows is still the king. 1. cloud-init support was in RHEL 7.2 which released November 19, 2015. A decade ago. 2. Checking on Ubuntu, it looks like it was supported in Ubuntu 18.04 LTS in April 2018. 3. For admining tens of thousands of servers, if you're in the RHEL ecosystem you use Satellite and it's ansible integration. That's also been going on for... about a decade. You don't need much integration though other than a host list of names and IPs. There are a lot of people on this list handling tens of thousands or hundreds of thousands of linux servers a day (probably a few in the millions). | |
| ▲ | max-privatevoid a day ago | parent | prev [-] | | I'm surprised no one has said NixOS yet. |
|
