From 7ffd4d99bbb8e358c6694c27c7ff859967872ece Mon Sep 17 00:00:00 2001 From: Marcos Magueta Date: Sun, 10 May 2026 02:27:08 -0300 Subject: comparison to nt ob --- include/PermissionsManager.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'include/PermissionsManager.h') diff --git a/include/PermissionsManager.h b/include/PermissionsManager.h index 65c00e5..2db1784 100644 --- a/include/PermissionsManager.h +++ b/include/PermissionsManager.h @@ -20,6 +20,22 @@ namespace nt * Permission checks are intentionally separated from lookup. The object * manager can retrieve a candidate object, while this manager decides * whether the caller is allowed to use it. + * + * Permissions are strictly capability-based and must be explicitly granted. + * There is no implicit flow of access rights from a parent namespace entry to + * its children (no SD inheritance). A caller who holds READ on a multigroup + * does not thereby hold READ on its constituent relations — that is a separate, + * explicit capability. + * + * @todo Define a security_descriptor structure. Store instances in a shared, + * content-addressed cache (keyed by descriptor content, not by namespace + * ancestry) so that identical ACLs are not duplicated across relations. + * See docs/reactos-ob-comparison.md §5 and §7. + * + * @todo Cache the result of Access() in HandlerManager::handle::granted_access + * at open time. Per-operation checks should then read from the handle + * rather than re-evaluating the descriptor on every call. + * See docs/reactos-ob-comparison.md §4. */ class NT_API PermissionsManager { -- cgit v1.2.3