[mod.computers.vax] UAF/Rightslist problem

lear@TOPAZ.RUTGERS.EDU (eliot lear) (07/24/86)

Hi.

	I have been playing around with rightslists on a uVax II and
have run into what appears to be a bug.  Consider the following:

	(1) I created a resource allocatable id called testid.
	(2) I created a user called test and granted him allocatable
	    rights to testid.

Thus:

  Name                             Value           Attributes
  TESTID                           %X8001000A      RESOURCE 
    Holder                           Attributes
    TEST                             RESOURCE 

Ok.  Next, I logged in as TEST and created four files.


Directory DUA0:[TEST]

DIR.LOG;1            [TEST]                (RWED,RWED,RE,RE)
NORMAL.TXT;1         [TEST]                (RWED,RWED,RE,RE)
NOTOK.TXT;1          TESTID                (RWED,RWED,RE,RE)
OKTOO.TXT;1          TESTID                (RWED,RWED,RE,RE)
          (IDENTIFIER=[TEST],OPTIONS=NOPROPAGATE,ACCESS=READ+WRITE+EXECUTE+DELETE+CONTROL)

Total of 4 files.

Dir.log was the directory listing.  Normal.Txt was a test to make sure
that TEST could create files as itself, OKTOO.TXT is what happened
when TEST created a file /own=[TESTID].  {I also note the lack of
[]s..}  Here is what I did with Notok.Txt.  I created it owned by TEST
(CREATE NOTOK.TXT) and then changed the ownership to TESTID via SET
FILE/OWN=[TESTID].  TEST can no longer control NOTOK.TXT while it can
still control OKTOO.TXT (note how CREATE tagged on the ACL).  The
question is: Where does the bug lie?  Should SET also add an ACL or
should an ACL not be required since TEST is in the TESTID rights
group?

						eliot

The mind is a wonderful thing to waste!!

[lear@topaz.rutgers.edu]
[{allegra,seismo}!topaz!lear]