I am interested in extending CAccessControlFilter for my needs but can't because it has a private attribute, and CAccessRule has some private methods which can't be accessed in sub-classes either. This makes it effectively impossible to extend them. Shouldn't protected be used instead of private? And should private really be used at all in the framework in favor of protected?
I agree that those private methods should be changed to protected.
For the private members, the convention used by Yii is that it will provide a getter or setter if it allows to be overridden. So you should override the corresponding getter or setter method instead of directly changing the member.