933 lines
18 KiB
HTML
933 lines
18 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of ACL</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>ACL</H1>
|
|
Section: File Formats (5)<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
<BR>BSD mandoc<BR>
|
|
Linux ACL
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
<B>acl</B>
|
|
|
|
- Access Control Lists
|
|
|
|
<A NAME="lbAC"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
This manual page describes POSIX Access Control Lists, which are used to
|
|
define more fine-grained discretionary access rights for files and
|
|
directories.
|
|
<A NAME="lbAD"> </A>
|
|
<H2>ACL TYPES</H2>
|
|
|
|
Every object can be thought of as having associated with it an ACL that
|
|
governs the discretionary access to that object; this ACL is referred to
|
|
as an access ACL. In addition, a directory may have an associated ACL
|
|
that governs the initial access ACL for objects created within that
|
|
directory; this ACL is referred to as a default ACL.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>ACL ENTRIES</H2>
|
|
|
|
An ACL consists of a set of ACL entries. An ACL entry specifies the
|
|
access permissions on the associated object for an individual user or a
|
|
group of users as a combination of read, write and search/execute
|
|
permissions.
|
|
<P>
|
|
|
|
An ACL entry contains an entry tag type, an optional entry tag
|
|
qualifier, and a set of permissions.
|
|
We use the term qualifier to denote the entry tag qualifier of an ACL entry.
|
|
<P>
|
|
|
|
The qualifier denotes the identifier of a user or a group, for entries
|
|
with tag types of ACL_USER or ACL_GROUP, respectively. Entries with tag
|
|
types other than ACL_USER or ACL_GROUP have no defined qualifiers.
|
|
<P>
|
|
|
|
The following entry tag types are defined:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="1"><B>ACL_USER_OBJ</B>
|
|
<DD>
|
|
The ACL_USER_OBJ entry denotes access rights for the file owner.
|
|
<DT id="2"><B>ACL_USER</B>
|
|
<DD>
|
|
ACL_USER entries denote access rights for users identified by
|
|
the entry's qualifier.
|
|
<DT id="3"><B>ACL_GROUP_OBJ</B>
|
|
<DD>
|
|
The ACL_GROUP_OBJ entry denotes access rights for the file group.
|
|
<DT id="4"><B>ACL_GROUP</B>
|
|
<DD>
|
|
ACL_GROUP entries denote access rights for groups identified by
|
|
the entry's qualifier.
|
|
<DT id="5"><B>ACL_MASK</B>
|
|
<DD>
|
|
The ACL_MASK entry denotes the maximum access rights that can be granted
|
|
by entries of type ACL_USER, ACL_GROUP_OBJ, or ACL_GROUP.
|
|
<DT id="6"><B>ACL_OTHER</B>
|
|
<DD>
|
|
The ACL_OTHER entry denotes access rights for processes
|
|
that do not match any other entry in the ACL.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
When an access check is performed, the ACL_USER_OBJ and ACL_USER entries
|
|
are tested against the effective user ID. The effective group ID, as
|
|
well as all supplementary group IDs are tested against the ACL_GROUP_OBJ
|
|
and ACL_GROUP entries.
|
|
<A NAME="lbAF"> </A>
|
|
<H2>VALID ACLs A valid ACL contains exactly one entry with each of the ACL_USER_OBJ,
|
|
|
|
</H2>
|
|
|
|
ACL_GROUP_OBJ, and ACL_OTHER tag types. Entries with ACL_USER and
|
|
ACL_GROUP tag types may appear zero or more times in an ACL. An ACL that
|
|
contains entries of ACL_USER or ACL_GROUP tag types must contain
|
|
exactly one entry of the ACL_MASK tag type. If an ACL contains no
|
|
entries of ACL_USER or ACL_GROUP tag types, the ACL_MASK entry is
|
|
optional.
|
|
<P>
|
|
|
|
All user ID qualifiers must be unique among all entries of
|
|
ACL_USER tag type, and all group IDs must be unique among all entries of
|
|
ACL_GROUP tag type.
|
|
|
|
<P>
|
|
|
|
<BR> The
|
|
Fn acl_get_file
|
|
|
|
function returns an ACL with zero ACL entries as the default ACL of a
|
|
directory, if the directory is not associated with a default ACL. The
|
|
Fn acl_set_file
|
|
|
|
function also accepts an ACL with zero ACL entries as a valid default ACL for
|
|
directories, denoting that the directory shall not be associated with a
|
|
default ACL. This is equivalent to using the
|
|
Fn acl_delete_def_file
|
|
|
|
function.
|
|
<A NAME="lbAG"> </A>
|
|
<H2>CORRESPONDENCE BETWEEN ACL ENTRIES AND FILE PERMISSION BITS</H2>
|
|
|
|
The permissions defined by ACLs are a superset of the permissions
|
|
specified by the file permission bits.
|
|
<P>
|
|
|
|
There is a correspondence between the file owner, group, and other
|
|
permissions and specific ACL entries: the owner permissions correspond
|
|
to the permissions of the ACL_USER_OBJ entry. If the ACL has an ACL_MASK
|
|
entry, the group permissions correspond to the permissions of the
|
|
ACL_MASK entry. Otherwise, if the ACL has no ACL_MASK entry, the group
|
|
permissions correspond to the permissions of the ACL_GROUP_OBJ entry.
|
|
The other permissions correspond to the permissions of the ACL_OTHER
|
|
entry.
|
|
<P>
|
|
|
|
The file owner, group, and other permissions always match the
|
|
permissions of the corresponding ACL entry. Modification of the file
|
|
permission bits results in the modification of the associated ACL
|
|
entries, and modification of these ACL entries results in the
|
|
modification of the file permission bits.
|
|
<A NAME="lbAH"> </A>
|
|
<H2>OBJECT CREATION AND DEFAULT ACLs The access ACL of a file object is initialized when the object is
|
|
|
|
</H2>
|
|
|
|
created with any of the
|
|
Fn creat ,
|
|
|
|
Fn mkdir ,
|
|
|
|
Fn mknod ,
|
|
|
|
Fn mkfifo ,
|
|
|
|
or
|
|
Fn open
|
|
|
|
functions. If a default ACL is associated with a directory, the
|
|
<I>mode</I>
|
|
|
|
parameter to the functions creating file objects and the default ACL of
|
|
the directory are used to determine the ACL of the new object:
|
|
<OL><P>
|
|
|
|
<LI>
|
|
|
|
The new object inherits the default ACL of the containing directory
|
|
as its access ACL.
|
|
<LI>
|
|
|
|
The access ACL entries corresponding to the file permission bits are
|
|
modified so that they contain no permissions that are not
|
|
contained in the permissions specified by the
|
|
<I>mode</I>
|
|
|
|
parameter.
|
|
</OL><P>
|
|
|
|
<P>
|
|
|
|
If no default ACL is associated with a directory, the
|
|
<I>mode</I>
|
|
|
|
parameter to the functions creating file objects and the file creation
|
|
mask (see
|
|
<A HREF="/cgi-bin/man/man2html?2+umask">umask</A>(2))
|
|
|
|
|
|
are used to determine the ACL of the new object:
|
|
<OL><P>
|
|
|
|
<LI>
|
|
|
|
The new object is assigned an access ACL containing entries of tag types
|
|
ACL_USER_OBJ, ACL_GROUP_OBJ, and ACL_OTHER. The permissions of these
|
|
entries are set to the permissions specified by the file creation mask.
|
|
<LI>
|
|
|
|
The access ACL entries corresponding to the file permission bits are
|
|
modified so that they contain no permissions that are not
|
|
contained in the permissions specified by the
|
|
<I>mode</I>
|
|
|
|
parameter.
|
|
</OL><P>
|
|
|
|
<A NAME="lbAI"> </A>
|
|
<H2>ACCESS CHECK ALGORITHM</H2>
|
|
|
|
A process may request read, write, or execute/search access to a file object
|
|
protected by an ACL. The access check algorithm determines whether access to
|
|
the object will be granted.
|
|
<OL><P>
|
|
|
|
<LI>
|
|
|
|
<B>If </B>the effective user ID of the process matches the user ID of the file object owner,
|
|
|
|
|
|
|
|
<B>then</B>
|
|
|
|
<P>
|
|
|
|
|
|
<BLOCKQUOTE>
|
|
|
|
<B>if</B>
|
|
|
|
the ACL_USER_OBJ entry contains the requested permissions, access is granted,
|
|
<P>
|
|
|
|
<B>else</B>
|
|
|
|
access is denied.
|
|
</BLOCKQUOTE>
|
|
|
|
<LI>
|
|
|
|
<B>else if</B>
|
|
|
|
the effective user ID of the process matches the qualifier of any entry
|
|
of type ACL_USER,
|
|
<B>then</B>
|
|
|
|
<P>
|
|
|
|
|
|
<BLOCKQUOTE>
|
|
|
|
<B>if</B>
|
|
|
|
the matching ACL_USER entry and the ACL_MASK entry contain the requested
|
|
permissions, access is granted,
|
|
<P>
|
|
|
|
<B>else</B>
|
|
|
|
access is denied.
|
|
</BLOCKQUOTE>
|
|
|
|
<LI>
|
|
|
|
<B>else if</B>
|
|
|
|
the effective group ID or any of the supplementary group IDs of the process
|
|
match the file group or the qualifier of any entry of type ACL_GROUP,
|
|
<B>then</B>
|
|
|
|
<P>
|
|
|
|
|
|
<BLOCKQUOTE>
|
|
|
|
<B>if</B>
|
|
|
|
the ACL contains an ACL_MASK entry,
|
|
<B>then</B>
|
|
|
|
|
|
<BLOCKQUOTE>
|
|
|
|
<B>if</B>
|
|
|
|
the ACL_MASK entry and any of the matching ACL_GROUP_OBJ or ACL_GROUP entries
|
|
contain
|
|
the requested permissions, access is granted,
|
|
<P>
|
|
|
|
<B>else</B>
|
|
|
|
access is denied.
|
|
<P>
|
|
|
|
</BLOCKQUOTE>
|
|
|
|
<B>else</B>
|
|
|
|
(note that there can be no ACL_GROUP entries without an ACL_MASK entry)
|
|
|
|
<BLOCKQUOTE>
|
|
|
|
<B>if</B>
|
|
|
|
the ACL_GROUP_OBJ entry contains the requested permissions,
|
|
access is granted,
|
|
<P>
|
|
|
|
<B>else</B>
|
|
|
|
access is denied.
|
|
</BLOCKQUOTE>
|
|
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
<LI>
|
|
|
|
<B>else if</B>
|
|
|
|
the ACL_OTHER entry contains the requested permissions, access is granted.
|
|
<LI>
|
|
|
|
<B>else</B>
|
|
|
|
access is denied.
|
|
</OL><P>
|
|
|
|
|
|
|
|
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>ACL TEXT FORMS</H2>
|
|
|
|
A long and a short text form for representing ACLs is defined. In both forms, ACL entries are represented as three colon separated fields: an ACL entry tag type, an ACL entry qualifier, and the discretionary access permissions. The first field contains one of the following entry tag type keywords:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="7"><B>user</B>
|
|
|
|
|
|
<DD>
|
|
A
|
|
<B>user</B>
|
|
|
|
ACL entry specifies the access granted to either the file owner (entry tag
|
|
type ACL_USER_OBJ) or a specified user (entry tag type ACL_USER).
|
|
<DT id="8"><B>group</B>
|
|
|
|
|
|
<DD>
|
|
A
|
|
<B>group</B>
|
|
|
|
ACL entry specifies the access granted to either the file group (entry tag
|
|
type ACL_GROUP_OBJ) or a specified group (entry tag type ACL_GROUP).
|
|
<DT id="9"><B>mask</B>
|
|
|
|
|
|
<DD>
|
|
A
|
|
<B>mask</B>
|
|
|
|
ACL entry specifies the maximum access which can be granted by any ACL
|
|
entry except the
|
|
<B>user</B>
|
|
|
|
entry for the file owner and the
|
|
<B>other</B>
|
|
|
|
entry (entry tag type ACL_MASK).
|
|
<DT id="10"><B>other</B>
|
|
|
|
|
|
<DD>
|
|
An
|
|
<B>other</B>
|
|
|
|
ACL entry specifies the access granted to any process that does
|
|
not match any
|
|
<B>user</B>
|
|
|
|
or
|
|
<B>group</B>
|
|
|
|
ACL entries (entry tag type ACL_OTHER).
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
The second field contains the user or group identifier of the user or
|
|
group associated with the ACL entry for entries of entry tag type ACL_USER
|
|
or ACL_GROUP, and is empty for all other entries. A user identifier can
|
|
be a user name or a user ID number in decimal form. A group identifier can
|
|
be a group name or a group ID number in decimal form.
|
|
<P>
|
|
|
|
The third field contains the discretionary access permissions. The read,
|
|
write and search/execute permissions are represented by the
|
|
<B>r</B>
|
|
|
|
|
|
<B>w</B>
|
|
|
|
|
|
and
|
|
<B>x</B>
|
|
|
|
characters, in this order. Each of these characters is replaced by the
|
|
<B>-</B>
|
|
|
|
character to denote that a permission is absent in the ACL entry.
|
|
When converting from the text form to the internal representation,
|
|
permissions that are absent need not be specified.
|
|
<P>
|
|
|
|
White space is permitted at the beginning and end of each ACL entry, and
|
|
immediately before and after a field separator (the colon character).
|
|
<A NAME="lbAK"> </A>
|
|
<H3>LONG TEXT FORM</H3>
|
|
|
|
The long text form contains one ACL entry per line. In addition, a
|
|
number sign
|
|
<B>( #</B>
|
|
|
|
|
|
|
|
|
|
may start a comment that extends until the end of the line. If an
|
|
ACL_USER, ACL_GROUP_OBJ or ACL_GROUP ACL entry contains permissions that
|
|
are not also contained in the ACL_MASK entry, the entry is followed by a
|
|
number sign, the string "effective:", and the effective access
|
|
permissions defined by that entry. This is an example of the long text
|
|
form:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
user::rw-
|
|
user:lisa:rw- #effective:r--
|
|
group::r--
|
|
group:toolies:rw- #effective:r--
|
|
mask::r--
|
|
other::r--
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<A NAME="lbAL"> </A>
|
|
<H3>SHORT TEXT FORM</H3>
|
|
|
|
The short text form is a sequence of ACL entries separated by commas,
|
|
and is used for input. Comments are not supported. Entry tag type
|
|
keywords may either appear in their full unabbreviated form, or in their
|
|
single letter abbreviated form. The abbreviation for
|
|
<B>user</B>
|
|
|
|
is
|
|
<B>u</B>
|
|
|
|
|
|
the abbreviation for
|
|
<B>group</B>
|
|
|
|
is
|
|
<B>g</B>
|
|
|
|
|
|
the abbreviation for
|
|
<B>mask</B>
|
|
|
|
is
|
|
<B>m</B>
|
|
|
|
|
|
and the abbreviation for
|
|
<B>other</B>
|
|
|
|
is
|
|
<B>o</B>
|
|
|
|
|
|
The permissions may contain at most one each of the following characters
|
|
in any order:
|
|
<B>r</B>
|
|
|
|
|
|
<B>w</B>
|
|
|
|
|
|
<B>x</B>
|
|
|
|
|
|
These are examples of the short text form:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
u::rw-,u:lisa:rw-,g::r--,g:toolies:rw-,m::r--,o::r--
|
|
g:toolies:rw,u:lisa:rw,u::wr,g::r,o::r,m::r
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<A NAME="lbAM"> </A>
|
|
<H2>RATIONALE</H2>
|
|
|
|
IEEE 1003.1e draft 17 defines Access Control Lists that include entries
|
|
of tag type ACL_MASK, and defines a mapping between file permission bits
|
|
that is not constant. The standard working group defined this relatively
|
|
complex interface in order to ensure that applications that are compliant
|
|
with IEEE 1003.1 ("POSIX.1") will still function as expected on
|
|
systems with ACLs. The IEEE 1003.1e draft 17 contains the rationale for
|
|
choosing this interface in section B.23.
|
|
<A NAME="lbAN"> </A>
|
|
<H2>CHANGES TO THE FILE UTILITIES</H2>
|
|
|
|
On a system that supports ACLs, the file utilities
|
|
<A HREF="/cgi-bin/man/man2html?1+ls">ls</A>(1),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?1+cp">cp</A>(1),
|
|
|
|
|
|
and
|
|
<A HREF="/cgi-bin/man/man2html?1+mv">mv</A>(1)
|
|
|
|
|
|
change their behavior in the following way:
|
|
<UL><P>
|
|
|
|
<LI>
|
|
|
|
For files that have a default ACL or an access ACL that contains more than
|
|
the three required ACL entries, the
|
|
<A HREF="/cgi-bin/man/man2html?1+ls">ls</A>(1)
|
|
|
|
|
|
utility in the long form produced by
|
|
<B>ls -l</B>
|
|
|
|
displays a plus sign
|
|
<B>( +</B>
|
|
|
|
|
|
|
|
|
|
after the permission string.
|
|
<LI>
|
|
|
|
If the
|
|
-<B>p</B>
|
|
|
|
flag is specified, the
|
|
<A HREF="/cgi-bin/man/man2html?1+cp">cp</A>(1)
|
|
|
|
|
|
utility also preserves ACLs.
|
|
If this is not possible, a warning is produced.
|
|
<LI>
|
|
|
|
<BR> The
|
|
<A HREF="/cgi-bin/man/man2html?1+mv">mv</A>(1)
|
|
|
|
|
|
utility always preserves ACLs. If this is not possible, a warning is produced.
|
|
</UL><P>
|
|
|
|
<P>
|
|
|
|
The effect of the
|
|
<A HREF="/cgi-bin/man/man2html?1+chmod">chmod</A>(1)
|
|
|
|
|
|
utility, and of the
|
|
<A HREF="/cgi-bin/man/man2html?2+chmod">chmod</A>(2)
|
|
|
|
|
|
system call, on the access ACL is described in
|
|
Sx CORRESPONDENCE BETWEEN ACL ENTRIES AND FILE PERMISSION BITS .
|
|
|
|
<A NAME="lbAO"> </A>
|
|
<H2>STANDARDS</H2>
|
|
|
|
The IEEE 1003.1e draft 17 ("POSIX.1e") document describes several
|
|
security extensions to the IEEE 1003.1 standard. While the work on
|
|
1003.1e has been abandoned, many UNIX style systems implement parts of
|
|
POSIX.1e draft 17, or of earlier drafts.
|
|
<P>
|
|
|
|
Linux Access Control Lists implement the full set of functions and
|
|
utilities defined for Access Control Lists in POSIX.1e, and several
|
|
extensions. The implementation is fully compliant with POSIX.1e draft
|
|
17; extensions are marked as such.
|
|
The Access Control List manipulation functions are defined in
|
|
the ACL library (libacl, -lacl). The POSIX compliant interfaces are
|
|
declared in the
|
|
<B><<A HREF="file:///usr/include/sys/acl.h">sys/acl.h</A>></B>
|
|
|
|
header. Linux-specific extensions to these functions are declared in the
|
|
<B><<A HREF="file:///usr/include/acl/libacl.h">acl/libacl.h</A>></B>
|
|
|
|
header.
|
|
<A NAME="lbAP"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<A HREF="/cgi-bin/man/man2html?1+chmod">chmod</A>(1),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?2+creat">creat</A>(2),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?1+getfacl">getfacl</A>(1),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?1+ls">ls</A>(1),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?2+mkdir">mkdir</A>(2),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?2+mkfifo">mkfifo</A>(2),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?2+mknod">mknod</A>(2),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?8+mount">mount</A>(8),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?2+open">open</A>(2),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?1+setfacl">setfacl</A>(1),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?2+stat">stat</A>(2),
|
|
|
|
|
|
<A HREF="/cgi-bin/man/man2html?1+umask">umask</A>(1)
|
|
|
|
|
|
<A NAME="lbAQ"> </A>
|
|
<H3>POSIX 1003.1e DRAFT 17</H3>
|
|
|
|
<A HREF="http://wt.tuxomania.net/publications/posix.1e/download.html">http://wt.tuxomania.net/publications/posix.1e/download.html</A>
|
|
|
|
|
|
<A NAME="lbAR"> </A>
|
|
<H3>POSIX 1003.1e FUNCTIONS BY CATEGORY</H3>
|
|
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="11"><B>ACL storage management</B>
|
|
|
|
|
|
<DD>
|
|
acl_dup3,
|
|
|
|
|
|
acl_free3,
|
|
|
|
|
|
acl_init3
|
|
|
|
|
|
<DT id="12"><B>ACL entry manipulation</B>
|
|
|
|
|
|
<DD>
|
|
acl_copy_entry3,
|
|
|
|
|
|
acl_create_entry3,
|
|
|
|
|
|
acl_delete_entry3,
|
|
|
|
|
|
acl_get_entry3,
|
|
|
|
|
|
acl_valid3
|
|
|
|
|
|
<P>
|
|
|
|
acl_add_perm3,
|
|
|
|
|
|
acl_calc_mask3,
|
|
|
|
|
|
acl_clear_perms3,
|
|
|
|
|
|
acl_delete_perm3,
|
|
|
|
|
|
acl_get_permset3,
|
|
|
|
|
|
acl_set_permset3
|
|
|
|
|
|
<P>
|
|
|
|
acl_get_qualifier3,
|
|
|
|
|
|
acl_get_tag_type3,
|
|
|
|
|
|
acl_set_qualifier3,
|
|
|
|
|
|
acl_set_tag_type3
|
|
|
|
|
|
<DT id="13"><B>ACL manipulation on an object</B>
|
|
|
|
|
|
<DD>
|
|
acl_delete_def_file3,
|
|
|
|
|
|
acl_get_fd3,
|
|
|
|
|
|
acl_get_file3,
|
|
|
|
|
|
acl_set_fd3,
|
|
|
|
|
|
acl_set_file3
|
|
|
|
|
|
<DT id="14"><B>ACL format translation</B>
|
|
|
|
|
|
<DD>
|
|
acl_copy_entry3,
|
|
|
|
|
|
acl_copy_ext3,
|
|
|
|
|
|
acl_from_text3,
|
|
|
|
|
|
acl_to_text3,
|
|
|
|
|
|
acl_size3
|
|
|
|
|
|
</DL>
|
|
<P>
|
|
|
|
<A NAME="lbAS"> </A>
|
|
<H3>POSIX 1003.1e FUNCTIONS BY AVAILABILITY</H3>
|
|
|
|
The first group of functions is supported on most systems with POSIX-like
|
|
access control lists, while the second group is supported on fewer systems.
|
|
For applications that will be ported the second group is best avoided.
|
|
<P>
|
|
|
|
acl_delete_def_file3,
|
|
|
|
|
|
acl_dup3,
|
|
|
|
|
|
acl_free3,
|
|
|
|
|
|
acl_from_text3,
|
|
|
|
|
|
acl_get_fd3,
|
|
|
|
|
|
acl_get_file3,
|
|
|
|
|
|
acl_init3,
|
|
|
|
|
|
acl_set_fd3,
|
|
|
|
|
|
acl_set_file3,
|
|
|
|
|
|
acl_to_text3,
|
|
|
|
|
|
acl_valid3
|
|
|
|
|
|
<P>
|
|
|
|
acl_add_perm3,
|
|
|
|
|
|
acl_calc_mask3,
|
|
|
|
|
|
acl_clear_perms3,
|
|
|
|
|
|
acl_copy_entry3,
|
|
|
|
|
|
acl_copy_ext3,
|
|
|
|
|
|
acl_copy_int3,
|
|
|
|
|
|
acl_create_entry3,
|
|
|
|
|
|
acl_delete_entry3,
|
|
|
|
|
|
acl_delete_perm3,
|
|
|
|
|
|
acl_get_entry3,
|
|
|
|
|
|
acl_get_permset3,
|
|
|
|
|
|
acl_get_qualifier3,
|
|
|
|
|
|
acl_get_tag_type3,
|
|
|
|
|
|
acl_set_permset3,
|
|
|
|
|
|
acl_set_qualifier3,
|
|
|
|
|
|
acl_set_tag_type3,
|
|
|
|
|
|
acl_size3
|
|
|
|
|
|
<A NAME="lbAT"> </A>
|
|
<H3>LINUX EXTENSIONS</H3>
|
|
|
|
These non-portable extensions are available on Linux systems.
|
|
<P>
|
|
|
|
acl_check3,
|
|
|
|
|
|
acl_cmp3,
|
|
|
|
|
|
acl_entries3,
|
|
|
|
|
|
acl_equiv_mode3,
|
|
|
|
|
|
acl_error3,
|
|
|
|
|
|
acl_extended_fd3,
|
|
|
|
|
|
acl_extended_file3,
|
|
|
|
|
|
acl_extended_file_nofollow3,
|
|
|
|
|
|
acl_from_mode3,
|
|
|
|
|
|
acl_get_perm3,
|
|
|
|
|
|
acl_to_any_text3
|
|
|
|
|
|
<A NAME="lbAU"> </A>
|
|
<H2>AUTHOR</H2>
|
|
|
|
Andreas Gruenbacher, <<A HREF="mailto:andreas.gruenbacher@gmail.com">andreas.gruenbacher@gmail.com</A>>
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="15"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="16"><A HREF="#lbAC">DESCRIPTION</A><DD>
|
|
<DT id="17"><A HREF="#lbAD">ACL TYPES</A><DD>
|
|
<DT id="18"><A HREF="#lbAE">ACL ENTRIES</A><DD>
|
|
<DT id="19"><A HREF="#lbAF">VALID ACLs</A><DD>
|
|
<DT id="20"><A HREF="#lbAG">CORRESPONDENCE BETWEEN ACL ENTRIES AND FILE PERMISSION BITS</A><DD>
|
|
<DT id="21"><A HREF="#lbAH">OBJECT CREATION AND DEFAULT ACLs</A><DD>
|
|
<DT id="22"><A HREF="#lbAI">ACCESS CHECK ALGORITHM</A><DD>
|
|
<DT id="23"><A HREF="#lbAJ">ACL TEXT FORMS</A><DD>
|
|
<DL>
|
|
<DT id="24"><A HREF="#lbAK">LONG TEXT FORM</A><DD>
|
|
<DT id="25"><A HREF="#lbAL">SHORT TEXT FORM</A><DD>
|
|
</DL>
|
|
<DT id="26"><A HREF="#lbAM">RATIONALE</A><DD>
|
|
<DT id="27"><A HREF="#lbAN">CHANGES TO THE FILE UTILITIES</A><DD>
|
|
<DT id="28"><A HREF="#lbAO">STANDARDS</A><DD>
|
|
<DT id="29"><A HREF="#lbAP">SEE ALSO</A><DD>
|
|
<DL>
|
|
<DT id="30"><A HREF="#lbAQ">POSIX 1003.1e DRAFT 17</A><DD>
|
|
<DT id="31"><A HREF="#lbAR">POSIX 1003.1e FUNCTIONS BY CATEGORY</A><DD>
|
|
<DT id="32"><A HREF="#lbAS">POSIX 1003.1e FUNCTIONS BY AVAILABILITY</A><DD>
|
|
<DT id="33"><A HREF="#lbAT">LINUX EXTENSIONS</A><DD>
|
|
</DL>
|
|
<DT id="34"><A HREF="#lbAU">AUTHOR</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:02 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|