Re: Clever delegation ??

[azb@llnl.gov (Tony Bartoletti)]

Bill Frantz wrote:
>I think that it is correct to say, if the parameter increases the
>privilege, then the combiner must do an intersection.  If the parameter
>reduces the privilege, as when the R/O parameter is added to limit the
>authorization to Read Only access, then the combiner needs to do an union.

If there were a way, given a tag with parameters formed of *-sets, to always
determine apriori that set-expansion grants greater, or lesser authority,
that would be, well, just swell.  But I am afraid this is an issue of how
the tag will be applied semantically.  Consider:

P1: (* set (day Monday Tuesday Wednesday))
P2: (* set (day Monday Tuesday))

P1 provides greater freedom than P2 if these are days you may take vacation.
P1 provides lesser freedom than P2 if these are days you may not take vacation.

Taking intersection or union depends upon knowing just what the tag "really
means".  I begin to wonder if each parameter of a tag should communicate its
role as a degree of restriction or of freedom.

____TONY____  (making trouble again.)

---

• Prev by Date: Re: Multi-Tag-Cert Tag Creation and Validation
• Next by Date: adding/subtracting permissions ??
• Prev by thread: Re: Clever delegation ??
• Next by thread: [frantz@netcom.com: Re: Clever delegation ??]
• Index(es):
  • Main
  • Thread