Post #2377563

2026-04-17 19:12 UTC

You know how ACLs/RBAC don't compose? Whereas object-capabilities do? We see this in-the-small with Unix user/group IDs. Trying to mount virtiofs from host-to-guest, everything is done by uid/gid, not by name, and if there's any mismatch, you get to keep both pieces. Exactly the same problem as trying to reconcile two ACL/RBAC databases across services, only slightly simplified by having at least a compatible schema and logical arrangement.

Replies (1)

@teajaygrey@snac.bsd.cafe 2026-05-07 15:06

(burnt out sysadmin, charred by the fires of NFS UID/GID mismatches across systems and some of the horrific workarounds his predecessors utilized as well as the more horrific alternatives such as Active Directory with its objectGUID, etc.) Ah yes, I know. ;) Some say: "ignorance is bliss!" However, the lack of ignorance, does not seem to be synonymous with bliss. ;(

Open ##2798486