Open System Services System Calls Reference Manual (G06.29+, H06.08+, J06.03+)

Miscellaneous acl(5)
• Members of the owning group
• Any additional user entries (optional users)
• Any additional group entries (members of any optional groups)
The class entry is useful because it allows you to restrict the permissions for all
of the other ACL entries by changing only one ACL entry. If optional user or
optional group ACL entries are present, the chmod command changes the per-
missions of the class ACL entry instead of the permissions of the owning group.
This behavior allows programs that use the chmod command to support files or
directories that have permissions for additional users and groups.
Optional ACL Entries
Optional ACL entries are ACL entries other than the base ACL entries. Optional
ACL entries grant permissions beyond the standard UNIX permissions and can
be used to further allow or deny access to the file. A file or directory is con-
sidered to "have an ACL" only if optional ACLs are present. In OSS, you can
specify up to 146 optional ACL entries in an ACL. You use the setacl command
or the acl() system call to set ACL entries. Nondefault optional ACL entries
include:
________________________________________________________________
Notation Entry Type Description
________________________________________________________________
user:uid:perm USER Permissions for the user specified by uid
group:gid:perm GROUP Permissions for the group specified by gid
________________________________________________________________
Examples of nondefault optional ACL entries:
u:mary:rwx
Grant read, write, and execute access to the user mary.
user:george:---
Deny access to the user george.
g:writers:rw-
Grant read and write access to all members of the group writers.
Actual ACL Entries
The base ACL entries, optional user ACL entries, and optional group ACL
entries are considered "actual" ACL entries because they actually control access
to the associated file or directory. These ACL entries are also called nondefault
ACL entries. Contrast with "Default ACL Entries."
Default ACL Entries
Default ACL entries are allowed for directories only. Default ACL entries do not
determine who can access the directory. Instead, default ACL entries affect the
access permissions for files or directories created in the directory (see "ACL
Inheritance" later in this reference page). All default ACL entries are optional
ACL entries. Default ACL entries include:
527186-023 Hewlett-Packard Company 12−5