[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: One more ACL question

Emmanuel Dreyfus <manu@netbsd.org> wrote:

> If it is not, is there a way to give the addition right without giving
> the delete right?

Following up myself:

Yes, it seems possible, according to the documentation
in order to add, one need write access to 
- attrs=childrens of the parent

in order to delete, one need write access to 
- attrs=childrens of the parent
- attrs=entry of the entry to be deleted

So it seems possible to do what I'm looking for, by using two ACL. Does
something like this look reasonable?

access to dn.regex="(ou=.+,o=home)$" attrs=children
    by group/netExampleService/manager.expand="$1" write stop
    by * read stop

access to filter="(!(locked=TRUE))" attrs=entry
    by group/netExampleService/manager write stop
    by * read stop

-- 
Emmanuel Dreyfus
http://hcpnet.free.fr/pubz
manu@netbsd.org