From: brian%jaguar.cs.utah.edu@cs.utah.edu (Brian Sturgill)
Subject: Re: MS's misconduct!
Date: 5 Oct 92 21:59:24 MDT
Organization: University of Utah CS Dept

In article <1992Oct5.230835.22607@ms.uky.edu> sam@ms.uky.edu (Mike Mills) writes:
>thg@cam-orl.co.uk (Tim Glauert) writes:
>
>>In article <1992Oct4.180905.27222@ms.uky.edu>, sam@ms.uky.edu (Mike Mills) writes:
>>|> IMHO, preemptive multitasking is a requirement.
>
>>OK, I agree.
>
>>|>  Also, any OS should be multiuser.
>
>>OK, I agree again, for a PC/Workstation OS.
>
>>|>  This is a shortcoming in both NT and OS/2.
>
>>Sorry, you lost me at this point. NT is fully multi-user. What are you trying
>>to say?
>
>>|> With machines
>>|> becoming more and more powerful, there is an increasing need for multiuser
>>|> operating systems, in order to take better advantage of the underlying
>>|> machine.
>
>>I agree. That is one reason I prefer NT to OS/2 2.0.
>
>
>Ok, perhaps I'm mistaken here.  From what I've read, NT offers symmetric
>multiprocessing and some other things, but is NOT multiuser.
>
>If NT is truly multiuser, then I must say that is one thing in its favor.
>
>Someone care to give the definititve answer on this?

Well if you'll take my word as "definitive", I'll give it.

NT has "multi-user" capabilities that exceed Unix.  I'll compare it against
Unix.

In most Unix a process has a user id and with each user id has an associate
set of group id's.  This set defines what files a user can access,
what devices (protected as if they were files) the user can access,
and if the user id is 0 then special system administrative privileges
are granted.
A few Unixes also allow access control lists (ACLs)
which typically allow a list of users id's that are specifically
forbidden or allowed to access a file.

NT goes beyond this.  Each thread has a security context consisting of
the logon session's identity, the user's logon (for file ownership
purposes), and a set of capabilities.  Most system objects (e.g. files,
processes, threads, synchronization objects) have ACL's that control
who can manipulate them.  Security on file systems only work under
NTFS.  (FAT and HPFS are not built for security.) There's the expect
set of API calls that allow the manipulation of the ACL's and that
allow authorization.  Plus there is a call that allows a server to
impersonate a client.

(Take this next part with a grain of salt... my monitor died, so
I'm without NT for a few days... someone else out there want to
verify this is possible?  I looked briefly at it before, but have
not actually done it.)
The user management system allows the creation of "groups" that
represent sets of capabilities.  Thus rather than having just
root/normal user granularty, NT can have "users" with partial system
admin priviledges...  thus allowing appropriate accounts for operators,
etc.  The user in a simple, secure environment (e.g. me at home) can
simply grant their normal user account all capabilities.  Thus you get
the best of both worlds appropriate granularity at complex sites;
simplicty at simple sites.

>--Mike Mills              E-Mail:  sam@ms.uky.edu, {rutgers, uunet}!ukma!sam

Brian
-- 
C. Brian Sturgill                I strongly encourage you to read Ross Perot's
University of Utah                             United We Stand
Center for Software Science             How we can take back our country.
brian@cs.utah.edu; CIS: 70363,1373  (It's more important than OS/2 vs NT! :-))