diff options
Diffstat (limited to 'include/PermissionsManager.h')
| -rw-r--r-- | include/PermissionsManager.h | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/include/PermissionsManager.h b/include/PermissionsManager.h index 65c00e5..2db1784 100644 --- a/include/PermissionsManager.h +++ b/include/PermissionsManager.h @@ -20,6 +20,22 @@ namespace nt * Permission checks are intentionally separated from lookup. The object * manager can retrieve a candidate object, while this manager decides * whether the caller is allowed to use it. + * + * Permissions are strictly capability-based and must be explicitly granted. + * There is no implicit flow of access rights from a parent namespace entry to + * its children (no SD inheritance). A caller who holds READ on a multigroup + * does not thereby hold READ on its constituent relations — that is a separate, + * explicit capability. + * + * @todo Define a security_descriptor structure. Store instances in a shared, + * content-addressed cache (keyed by descriptor content, not by namespace + * ancestry) so that identical ACLs are not duplicated across relations. + * See docs/reactos-ob-comparison.md §5 and §7. + * + * @todo Cache the result of Access() in HandlerManager::handle::granted_access + * at open time. Per-operation checks should then read from the handle + * rather than re-evaluating the descriptor on every call. + * See docs/reactos-ob-comparison.md §4. */ class NT_API PermissionsManager { |