Re: [macker-user] allow and nested allow

[Paul C. <can...@po...>]

Bienvenue, Florent.  Good question.  The difference is that the nested "allow"
applies only as an exception to the outer "deny".  If you have only one "deny",
there is no difference.

However, if you set up a more complex rule, there is a difference.  For example,
this would allow a reference from "factory" to "inside-sensitive" ...

   <deny><to pattern="inside" /></deny>
   <deny><to pattern="inside-sensitive" /></deny>
   <allow><from pattern="inside" /></allow>
   <allow><from pattern="factory" /></allow>

..but this would *not*:

   <deny>
     <to pattern="inside" />
     <allow><from pattern="inside" /></allow>
     <allow><from pattern="factory" /></allow>
   </deny>
   <deny>
     <to pattern="inside-sensitive" />
     <allow><from pattern="inside" /></allow>
   </deny>

Here are the nested and non-nested forms mixed (this is equivalent to the second
example above):

   <deny>
     <to pattern="inside" />
     <allow><from pattern="factory" /></allow>
   </deny>
   <deny>
     <to pattern="inside-sensitive" />
   </deny>
   <allow><from pattern="inside" /></allow>

Hope this helps clarify!

In practice, you'll rarely need to write patterns this complex, I hope....

Cheers,

Paul


Quoting Florent Zara <fza...@fr...>:
> Hello,
> 
> First, thank you for your tool. It's quite usefull. But after plying at
> bit with it, I have the following question:
> 
> What is the pratical difference between "allow" at the same level as
> "deny" and "allow" nested inside a "deny" ? I've read the documentation
> that says it theorically behaves somehow like include/exclude, but in
> practice, I've run the modularity exemple with both and I have exactly
> the same results. here is the modified part:
> <access-rule>
>   <message>${from} must access the ${module} module through its
> API</message>
>   <deny>
>     <to pattern="inside" />
>     <allow><from pattern="inside" /></allow>
>     <allow><from pattern="factory" /></allow>
>   </deny>
> </access-rule>
> 
> May you give me more precision on that issue ?
> 
> Thanks in advance
> 
> Florent
> 
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: IBM Linux Tutorials
> Free Linux tutorial presented by Daniel Robbins, President and CEO of
> GenToo technologies. Learn everything from fundamentals to system
> administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
> _______________________________________________
> Macker-user mailing list
> Mac...@li...
> https://lists.sourceforge.net/lists/listinfo/macker-user
> 
> Macker home page: http://innig.net/macker/