================================
Defined detail.

Xie Huagang.
================================

* inherit and no_inherit 
<1> s..
    a has capability cap_xxx and is not inherit.
    b is a children of a and has capability cap_xxx and cap_yyy..no_inherit.
    c is a children of b 
    d is a children of c 

when b start, do_execve() 

search_lids_acl got the cap_xxx and cap_yyy into lids_sys_acl->flags.
lids_set_flag()
	
	if ( current->pptr->lids_sys_acl)
          /* from the parent's inherit_flags, clear the cap_effective bit. */
		inherit  = current->pptr->lids_sys_acl->inherit_flags.
		....
	if ( current->lids_sys_acl )
 		current->cap_effective |= flags

for a.. it got nothing from inherit_flags. and it now flags 2) is cap_xxx,
 
for b.. it got inherit from a and clear the cap_xxx bit in cap_effective.

for c .. it got inhert from b and clear cap_xxx and cap_yyy in cap_effective, 
		now cap_effective has no cap_xxx and cap_yyy.

for d .. it got nothing from c and the lids_set_flags does nothing. It inherit the cap_effective and has no cap_xxx and cap_yyy.


exeception... 
<2> default if inherit is effective ?? 

inherit = 0 , inherit = 0010000000000001000000000,

subject_ino,subject_dev, 

3 type of list.
================
READ

APPEND

WRITE

DENY
----------
<0> When system start up, read the /etc/lids.conf and 
redirect it into 2 catlog.
o system capability.
	struct lids_sys_cap {
		int type;
		i_ino ino;
		k_dev dev;
	}

o individual capability.
define a specied system, which file he can R/W/A or DENY to access a files.

When access a resouce(object) with a access type READ/WRITE/APPEND/CONTROL, 

<1> check the system capabilty if the resouce is denied/R/W accessed.
	
	o get the resouce's defined capability. 
	 {
		inode = current_one.
		fetch its inode,dev.
		while(inode is not the "\"){
			if(found_check_all_record)
				return type.
		}
		return -1;
	 }
				
	??????	problem: how to speed up?
	o check if the required access type <= defined.
	
	if it is , return no_limited.
	o else check the indivual capability.		
-----------------------------------------------------
    if (no limited)
	 go head.
    else 
	check the indivual capability
-----------------------------------------------------
<2> check the indivual capability, 
	o check if the required resource is defined as capability.
		o get a capability.
		  use the requried resouce's (ino,dev) to check if 
		  it is a parent or itself.
		o if match one, use the access type and return the type.
		
	o  if found , compare the return_type and requried type.
		if(requried <= return_type)
			go head.
		else 
			denied. 
	o else  denied.
	if ( can R/W/A)
		go ahead()
	else
		DENY.

----------------------------------------------------------------
when exec a program, to give it the ability of someting.
It indicate that this process can R/W/A to somefiles.

when access some resource, check if it is denied by this program.
if it is, 

NOTE:

<1> the access control list (ACL) defined the resource.
<2> ...


..........................

struct lids_task_acl {

	struct lids_task_acl *next;
	struct lids_acl *acl;
}
