HP-UX Reference (11i v3 07/02) - 5 Miscellaneous Topics (vol 9)

a
acl(5) acl(5)
Access Control List Entries
An access control list (ACL) consists of sets of
(user.group,mode) entries associated with a file that
specify permissions. Each entry specifies for one user-ID/group-ID combination a set of access permissions,
including read, write, and execute/search.
To help understand the relationship between access control lists and traditional file permissions, consider
the following file and its permissions:
-rwxr-xr-- james admin datafile
The file owner is user james
.
The file’s group is
admin.
The name of the file is
datafile
.
The file owner permissions are
rwx.
The file group permissions are
r-x.
The file other permissions are
r--.
In an ACL, user and group IDs can be represented by names or numbers, found in
/etc/passwd . The
following special symbols can also be used:
% Symbol representing no specific user or group.
@ Symbol representing the current file owner or group.
Base ACL Entries
When a file is created, three base access control list entries are mapped from the file’s access permission
bits to match a file’s owner and group and its traditional permission bits. Base ACL entries can be changed
by the chmod(2) and setacl(2) system calls.
(uid.%,mode)
Base ACL entry for the file’s owner
(%.gid,mode)
Base ACL entry for the file’s group
(%.%,mode) Base entry for other users
(Except where noted, examples are represented in short form notation. See ACL Notation, below.)
Optional ACL entries
Optional access control list entries contain additional access control information, which the user can set
with the setacl(2) system call to further allow or deny file access. Up to thirteen additional user/group com-
binations can be specified.
For example, the following optional access control list entries can be associated with our file:
(mary.admin,rwx)
Grant read, write, and execute access to user mary in group admin.
(george.%,---) Deny any access to user george in no specific group.
ACL Notation
Supported library calls and commands that manage ACLs recognize three different symbolic representa-
tions:
operator form For input of entire ACLs and modifications to existing ACLs, in a syntax similar to that
used by chmod(1).
short form Easier to read, intended primarily for output. chacl(1) accepts this form as input so that it
can interpret output from lsacl(1).
long form A multiline format useful for greater clarity, and supported only for output.
For our example file, the base ACL entries could be represented in the three notations as follows:
operator form
james.% = rwx, %.admin = rx, %.% = r
short form (james.%,rwx) (%.admin,r-x) (%.%,r--)
long form rwx james.%
r-x %.admin
r-- %.%
In addition to basic ACL usage, some library calls and commands understand and use a variation of opera-
tor and short forms. See the section below on ACL Patterns.
HP-UX 11i Version 3: February 2007 − 2 − Hewlett-Packard Company 25