1ACL(5) BSD File Formats Manual ACL(5)
2
4 acl — Access Control Lists
5
7 This manual page describes POSIX Access Control Lists, which are used to
8 define more fine-grained discretionary access rights for files and direc‐
9 tories.
10
12 Every object can be thought of as having associated with it an ACL that
13 governs the discretionary access to that object; this ACL is referred to
14 as an access ACL. In addition, a directory may have an associated ACL
15 that governs the initial access ACL for objects created within that di‐
16 rectory; this ACL is referred to as a default ACL.
17
19 An ACL consists of a set of ACL entries. An ACL entry specifies the ac‐
20 cess permissions on the associated object for an individual user or a
21 group of users as a combination of read, write and search/execute permis‐
22 sions.
23 An ACL entry contains an entry tag type, an optional entry tag qualifier,
25 and a set of permissions. We use the term qualifier to denote the entry
26 tag qualifier of an ACL entry.
27 The qualifier denotes the identifier of a user or a group, for entries
29 with tag types of ACL_USER or ACL_GROUP, respectively. Entries with tag
30 types other than ACL_USER or ACL_GROUP have no defined qualifiers.
31 The following entry tag types are defined:
33 ACL_USER_OBJ The ACL_USER_OBJ entry denotes access rights for
35 the file owner.
36 ACL_USER ACL_USER entries denote access rights for users
38 identified by the entry's qualifier.
39 ACL_GROUP_OBJ The ACL_GROUP_OBJ entry denotes access rights for
41 the file group.
42 ACL_GROUP ACL_GROUP entries denote access rights for groups
44 identified by the entry's qualifier.
45 ACL_MASK The ACL_MASK entry denotes the maximum access
47 rights that can be granted by entries of type
48 ACL_USER, ACL_GROUP_OBJ, or ACL_GROUP.
49 ACL_OTHER The ACL_OTHER entry denotes access rights for pro‐
51 cesses that do not match any other entry in the
52 ACL.
53 When an access check is performed, the ACL_USER_OBJ and ACL_USER entries
55 are tested against the effective user ID. The effective group ID, as well
56 as all supplementary group IDs are tested against the ACL_GROUP_OBJ and
57 ACL_GROUP entries.
58
60 A valid ACL contains exactly one entry with each of the ACL_USER_OBJ,
61 ACL_GROUP_OBJ, and ACL_OTHER tag types. Entries with ACL_USER and
62 ACL_GROUP tag types may appear zero or more times in an ACL. An ACL that
63 contains entries of ACL_USER or ACL_GROUP tag types must contain exactly
64 one entry of the ACL_MASK tag type. If an ACL contains no entries of
65 ACL_USER or ACL_GROUP tag types, the ACL_MASK entry is optional.
66 All user ID qualifiers must be unique among all entries of ACL_USER tag
68 type, and all group IDs must be unique among all entries of ACL_GROUP tag
69 type.
70 The acl_get_file() function returns an ACL with zero ACL entries as the
72 default ACL of a directory, if the directory is not associated with a de‐
73 fault ACL. The acl_set_file() function also accepts an ACL with zero ACL
74 entries as a valid default ACL for directories, denoting that the direc‐
75 tory shall not be associated with a default ACL. This is equivalent to
76 using the acl_delete_def_file() function.
77