Open System Services System Calls Reference Manual (G06.28+, H06.05+)

Miscellaneous acl(5)
permissions specified in the class entry bitwise-ANDed with the result of bitwise-ORing
together all of the permissions in all matching group entries. Otherwise, continue to the
next check.
4. Grant the permissions specified in the other: ACL entry.
Because the checks are performed in this order and the ID match checking stops when a match is
found, you can use optional user or group ACL entries with restrictive permissions to deny
access to certain users or groups.
If the EGID, the supplementary GIDs of the process, or both match the GIDs of multiple group
ACL entries for a file, the process is granted the permissions of all of the matching group entries,
restricted by the permissions in the class entry. For example, assume that the effective user ID for
a process represents the user beta, and the group IDs for that process represent group member-
ship only in the dos and tres groups. In this example, that process is allowed to open the file
/a/file with read/write access, because the group:dos: entry granted read access, the group:tres:
entry granted write access, and the class: entry allowed read and write access.
# file: /a/file
# owner: creator_uid
# group: creator_gid
user::rw-
group::rw-
group:dos:r--
group:tres:-w-
class:rw-
other:r--
ACL Operations Supported
• The acl() system call sets, retrieves, or counts ACLs.
• The setacl command sets or modifies ACLs.
• The getacl command retrieves ACLs.
• The -acl option of the find command locates files with certain ACL properties.
• The cp, cpio -p, mv, and pax -rw commands copy ACLs with the source files to the des-
tination files.
• The Backup and Restore 2 utility backs up ACLs with the files on tape and restores
ACLs with the files back to disk.
ACL Interaction with stat(), chmod(), and chown()
stat() The st_mode field summarizes the access rights to the file. It differs from file per-
mission bits only if the file has one or more optional ACL entries. If one or more
optional ACL entries are present in the ACL of the file, the permissions specified
in the class entry of the ACL are returned as the permissions for group in the
st_mode field. Because of this behavior, programs that use the stat() or chmod()
functions and are ignorant of ACLs are more likely to produce expected results.
The st_acl field indicates the presence of optional ACL entries in the ACL for
the file. The st_basemode field provides the owning user permissions, owning
group permissions, and other permissions for the file.
chmod() Using the chmod() function to set the group permission bits affects the class:
entry for the file, which in turn affects the permissions granted by additional
user:uid: and group:gid: entries. In particular, using chmod() to set file per-
mission bits to all zeros removes all access to the file, regardless of permissions
527186-007 Hewlett-Packard Company 12−9