[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Handle-info] admin question and further security considerations


On Feb 11, 2008, at 2:19 AM, Konstantin Rekk wrote:

Hi All,

I am puzzling with the admin settings/permission layout.

My main question is where exactly to put/How to organize
admin settings.
Listing them in the O.NA/prefix handle or
putting them in extra handles like prefix/ADMIN_XXX ?

It depends upon what the permissions are. Permissions in the prefix/ ADMIN_XXX handle apply only to the prefix/ADMIN_XXX handle itself. Some of those permissions (create-NA/delete-NA/create-hdl) will simply be ignored in non-prefix (0.NA/*) handles.

In 0.NA/prefix most permissions apply only to the 0.NA/prefix handle itself. Other permissions grant the ability to create handles under that prefix (create-handle), create sub-prefixes (add-NA) or delete the prefix handle itself (delete-NA)

How do the admin permission flag effects exactly depend on
the context/scope ? For example, is there a difference between setting
ADD_HANDLE in 0.NA/prefix for some HS_ADMIN value there and
the same in a prefix/ADMIN_XXX ?

Setting ADD_HANDLE in prefix/ADMIN_XXX won't have any effect. The admin rights apply to the handle in which they are contained (directly, not by reference). In the case of prefix handles (0.NA/*) the permissions may grant rights to perform operations under that namespace (create hdl, etc).

I also couldn't keep my hands from playing around with our test na
handle ;-) 0.NA/10081 . It suprised me, probably due to some
misunderstanding I have, that I could do the following:

From standard starting situation (0.NA/10081) : 
100 HS_ADMIN referencing 0.NA/0.NA with big boss permissions
101 HS_ADMIN with handle=0.NA/10081; index=300; [create hdl,delete
hdl,add val,read val,modify val,add admin,list]

Using 101's permissions I was able to add a HS_PUBKEY (add val),

That makes sense. You should be able to change your own public key.

adding a 102 HS_ADMIN (add admin) with [create hdl,delete hdl,add
val,read val,modify val,del admin,add admin,list] extended permissions.


Using 102 I could extend permissions for 101 :
[create hdl,delete hdl,create NA,add val,read val,modify val,del
admin,add admin,list]
Using 102 I could delete the big boss at 100.
And then I created using 101 a sub-na:
0.NA/10081.1 , just with email and HS_ADMIN to test permission effects.

That is not right - you shouldn't have been given the add_admin permission on the prefix handle. This seems like either your prefix was misconfigured to begin with or Jane trusts you. Expect that to be corrected soon unless you had previously arranged for the additional permissions :)

Thanks,
Sean


All that is probably ok, but gives me the impression that I need further
explanations before going to set up different admins otherwise I could
create inconsistent permission settings.

Would really appreciate if somebody here could provide further
explanations. Thanks!

Konstantin 


_______________________________________________
Handle-Info mailing list
Handle-Info@cnri.reston.va.us
http://www.handle.net/mailman/listinfo/handle-info