Mailing-List: contact bugs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache HTTPD Bugs Notification List" <bugs@httpd.apache.org>
From: bugzilla@apache.org
To: bugs@httpd.apache.org
Subject: [Bug 60946] "Require not env" generates error
Date: Fri, 31 Mar 2017 18:58:55 +0000
Message-ID: <bug-60946-7868-1Vtu4bqA9C@https.bz.apache.org/bugzilla/>
In-Reply-To: <bug-60946-7868@https.bz.apache.org/bugzilla/>
References: <bug-60946-7868@https.bz.apache.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Auto-Submitted: auto-generated
MIME-Version: 1.0
archived-at: Fri, 31 Mar 2017 18:59:00 -0000

https://bz.apache.org/bugzilla/show_bug.cgi?id=3D60946

--- Comment #6 from Jacob Champion <jchampion@apache.org> ---
(In reply to Philip Prindeville from comment #5)
> (In reply to Jacob Champion from comment #4)
>=20
> > <idle thoughts>
> > Does part of the confusion stem from the fact that we are <RequireAny> =
by
> > default instead of <RequireAll>? Switching that alone might make some t=
hings
> > more intuitive.
> > </idle thoughts>
>=20
> Except that when one things of traditional mandatory access controls like
> ACLs and such, you execute the rules until you get your first conclusive
> match...  which is what <RequireAny> does.

While that might be true -- and I'm not convinced that's an accurate
description of all MAC systems -- we're not using an ACL (or a MAC)
authorization system here. It's a very flexible (perhaps too flexible),
multi-paradigm system, and I would argue that you're just as likely to see
role-based authz with some of the more advanced authorization modules.

Perhaps the best thing to agree on is that any behavior might be "astonishi=
ng"
to some, and we should try to do what is least astonishing to the widest
possible range of users.

Anyway: there's a good chance that this is neither here nor there. Maybe al=
l we
need to do is review what directives are considered neutral/success/failure=
 in
the authz system.

--=20
You are receiving this mail because:
You are the assignee for the bug.=

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org