Why would you have to consider the descendent entries on disk when you
are only changing an entry in the parent? The effects of that change
are only computed in memory when the dentry for a child is created, so
you don't have to do a bunch of disk churning to change permissions on
the whole tree. In fact, all of the children may very well have NO acl
of their own stored on disk, which also saves space.
The whole idea here is that there is ONE acl that applies to the whole
tree, rather than have every object in the tree have its own acl.
That's why every object in the tree on the disk is not effected by a
change.
It will not take anywhere NEAR minutes at a time to update the in memory
dentries, more like 50ms.
-
