1.\" $NetBSD: genfs_can_access_acl_posix1e.9,v 1.1 2022/01/17 19:08:06 christos Exp $ 2.\"- 3.\" Copyright (c) 2001 Robert N. M. Watson 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 15.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25.\" SUCH DAMAGE. 26.\" 27.\" $FreeBSD: head/share/man/man9/genfs_can_access_acl_posix1e.9 206622 2010-04-14 19:08:06Z uqs $ 28.\" 29.Dd January 17, 2022 30.Dt GENFS_CAN_ACCESS_ACL_POSIX1E 9 31.Os 32.Sh NAME 33.Nm genfs_can_access_acl_posix1e 34.Nd generate a POSIX.1e ACL access control decision using vnode parameters 35.Sh SYNOPSIS 36.In miscfs/genfs/genfs.h 37.Ft int 38.Fo genfs_can_access_acl_posix1e 39.Fa "struct vnode *vp" 40.Fa "kauth_cred_t cred" 41.Fa "uid_t file_uid" 42.Fa "gid_t file_gid" 43.Fa "mode_t file_mode" 44.Fa "struct acl *acl" 45.Fa "accmode_t accmode" 46.Fc 47.Sh DESCRIPTION 48This call implements the logic for the 49.Ux 50discretionary file security model 51with POSIX.1e ACL extensions. 52It accepts the vnode 53.Fa vp , 54requesting credential 55.Fa cred , 56owning UID 57.Fa file_uid , 58owning GID 59.Fa file_gid , 60file permissions 61.Fa file_mode , 62access ACL for the file 63.Fa acl , 64and 65desired access mode 66.Fa accmode . 67.Pp 68This call is intended to support implementations of 69.Xr VOP_ACCESS 9 , 70which will use their own access methods to retrieve the vnode properties, 71and then invoke 72.Fn genfs_can_access_acl_posix1e 73in order to perform the actual check. 74Implementations of 75.Xr VOP_ACCESS 9 76may choose to implement additional security mechanisms whose results will 77be composed with the return value. 78.Pp 79The algorithm used by 80.Fn genfs_can_access_acl_posix1e 81is based on the POSIX.1e ACL evaluation algorithm. 82The algorithm selects a 83.Em matching 84entry from the access ACL, which may 85then be composed with an available ACL mask entry, providing 86.Ux 87security compatibility. 88.Pp 89Once appropriate protections are selected for the current credential, 90the requested access mode, in combination with the vnode type, will be 91compared with the discretionary rights available for the credential. 92If the rights granted by discretionary protections are insufficient, 93then super-user privilege, if available for the credential, will also be 94considered. 95.Sh RETURN VALUES 96.Fn genfs_can_access_acl_posix1e 97will return 0 on success, or a non-zero error value on failure. 98.Sh ERRORS 99.Bl -tag -width Er 100.It Bq Er EACCES 101Permission denied. 102An attempt was made to access a file in a way forbidden by its file access 103permissions. 104.It Bq Er EPERM 105Operation not permitted. 106An attempt was made to perform an operation limited to processes with 107appropriate privileges or to the owner of a file or other resource. 108.El 109.Sh SEE ALSO 110.Xr genfs_can_access 9 , 111.Xr vnode 9 , 112.Xr VOP_ACCESS 9 113.Sh AUTHORS 114This manual page and the current implementation of 115.Fn genfs_can_access_acl_posix1e 116were written by 117.An Robert Watson . 118.Sh BUGS 119This manual page should include a full description of the POSIX.1e ACL 120evaluation algorithm, or cross reference another page that does. 121