5.2.5.1 AIX Access Control Lists

An AIX ACL contains these fields (the text in italics to the right describes the line contents):

attributes:		  Special modes like SUID.
base permissions		  Normal UNIX file modes:
    owner(chavez): rw-		   User access.
    group(chem): rw-		   Group access.
    others: r--		   Other access.
extended permissions		  More specific permissions entries:
    enabled		   Whether they're used or not.
    specify  r-- u:harvey		   Permissions for user harvey.
    deny     -w- g:organic		   Permissions for group organic.
    permit   rw- u:hill, g:bio	 	   Permissions for user hill when in group bio.

The first line specifies any special attributes on the file (or directory). The possible attribute keywords are SETUID, SETGID, and SVTX (sticky bit is set). Multiple attributes are all placed on one line, separated by commas.

The next section of the ACL lists the base permissions for the file or directory. These correspond exactly to the UNIX file modes. Thus, for the file we"re looking at, the owner (who is chavez) has read and write access, members of the group chem (which is the group owner of the file) also have read and write access, and all others have read access.

The final section specifies extended permissions for the file: access information specified by user and group name. The first line in this section is either the word enabled or disabled, indicating whether the extended permissions that follow are actually used to determine file access or not. In our example, extended permissions are in use.

The rest of the lines in the ACL are access control entries (ACES), which have the following format:

operation  access-types  user-and-group-info

where the operation is one of the keywords permit, deny, or specify, which correspond to chmod's +, -, and = operators, respectively. permit adds the specified permissions to the ones the user already has, based on the base permissions; deny takes away the specified access; and specify sets the access for the user to the listed value. The access-types are the same as those for normal UNIX file modes. The user-and-group-info consists of a user name (preceded by u:) or one or more group names (each preceded by g:) or both. Multiple items are separated by commas.

Let"s look again at the ACES in our sample ACL:

specify  r--     u:harvey
deny     r--     g:organic
permit   rw-     u:hill, g:bio

The first line grants read-only access to user harvey on this file. The second line removes read access for the organic group from whatever permissions a user in that group already has. The final line adds read and write access to user hill while group bio is part of the current group set. By default, the current group set is all of the groups to which the user belongs.

ACLS that specify a username and group are useful mostly for accounting purposes; the ACL shown earlier ensures that user hill has group bio active when working with this file. They are also useful if you add a user to a group on a temporary basis, ensuring that the added file access goes away if the user is later removed from the group. In the previous example, user hill would no longer have access to the file if she were removed from the bio group (unless, of course, the file's base permissions grant it to her).

If more than one item is included in the user-and-group-info, then all of the items must be true for the entry to be applied to a process (AND logic). For example, the first ACE below is applied only to users who "have both bio and chem in their group sets" (which is often equivalent to "are members of both the chem and bio groups"):

permit   rw-    g:chem, g:bio
permit   rw-    u:hill, g:chem, g:bio

The second ACE applies to user hill only when both groups are in the current group set. If you wanted to grant write access to anyone who was a member of either group chem or group bio, you would specify two separate entries:

permit   rw-    g:chem
permit   rw-    g:bio

At this point, you might wonder what happens when more than one entry applies. When a process requests access to a file with extended permissions, the permitted accesses from the base permissions and all applicable ACES - all ACES which match the user and group identity of the process - are combined via a union operation. The denied accesses from the base permissions and all applicable ACES are also combined. If the requested access is permitted and it is not denied, then it is granted. Thus, contradictions among ACES are resolved in the most conservative way: access is denied unless it is both permitted and not denied.

For example, consider the ACL below:

attributes:  base permissions
    owner(chavez): rw-
    group(chem): r--
    others:         ---
extended permissions
    enabled
    specify         r--   u:stein
    permit          rw-   g:organic, g:bio
    deny            rwx   g:physics

Now suppose that the user stein, who is a member of both the organic and bio groups (and not a member of the chem group), wants write access to this file. The base permissions clearly grant stein no access at all to the file. The ACES in lines one and two of the extended permissions apply to stein. These ACES grant him read access (lines one and two) and write access (line two). They also deny him write and execute access (implicit in line one). Thus, stein will not be given write access because while the combined ACES do grant it to him, they also deny write access, and so the request will fail.

NOTE: The base permissions on a file with an extended access control list may be changed with chmod's symbolic mode, and any changes made in this way will be reflected in the base permissions section of the ACL. However, chmod's numeric mode must not be used for files with extended permissions, because using it automatically disables them.

ACLS may be applied and modified with the acledit command. acledit retrieves the current ACL for the file specified as its argument and opens it for editing, using the text editor specified by the EDITOR environment variable. The use of this variable under AIX is different from its use in other UNIX systems.[18] For one thing, no default exists (most UNIX implementations use vi when EDITOR is unset). For another, AIX requires that the full pathname to the editor be supplied, rather than only the filename.[19]

[18] As are many things in AIX.

[19] E.g., /bin/vi, not vi.

Once in the editor, make any changes to the ACL that you wish. If you are adding extended permission ACES, be sure to change disabled to enabled in the first line of that section. When you are finished, exit from the editor normally. AIX will then print the message:

Should the modified ACL be applied? (y)

If you wish to discard your changes to the ACL, enter "n"; otherwise, you should enter a carriage return. AIX will then check the new ACL, and if it has no errors, apply it to the file. If there are errors in the ACL (misspelled keywords or usernames are the most common), you will be placed back in the editor where you can correct the errors and try again. AIX will put error messages like the following example at the bottom of the file, describing the errors it found:

* line number  9: unknown keyword: spceify
* line number 10: unknown user: chavze

You don't need to delete the error messages themselves from the ACL.

However, this is the slow way of applying an ACL. The aclget and aclput commands offer alternative ways to display and apply ACLS to files.

aclget takes a filename as its argument, and displays the corresponding ACL on standard output (or to the file specified in its -o option).

The aclput command is used to read an ACL from a text file. By default, it takes its input from standard input, or from an input file specified with the -i option. Thus, to set the ACL for the file gold to the one stored in the file metal.acl, you could use this command:

$ aclput -i metal.acl gold

This form of aclput is useful if you use only a few different ACLS, all of which are saved as separate files to be applied as needed.

To copy an ACL from one file to another, put aclget and aclput together in a pipe. For example, the command below copies the ACL from the file silver to the file emerald:

$ aclget silver | aclput emerald

To copy an ACL from one file to a group of files, use xargs:

$ ls *.dat *.old | xargs -i /bin/sh -c "aclget silver | aclput {}"

These commands copy the ACL in silver to all the files ending in .dat and .old in the current directory.

You can use the ls -le command to quickly determine whether a file has an extended permissions set or not:

$ ls -le *_acl
-rw-r-----+   1 chavez  chem           51 Mar 20 13:27  has_acl
-rwxrws----   2 chavez  chem          512 Feb 08 17:58  no_acl

The plus sign appended to the normal mode string indicates the presence of extended permissions; the minus sign is present otherwise.

5.2.5.2 HP-UX access control lists

The lsacl command can be used to view the access control list for a file. For a file having only normal UNIX file modes set, the output looks like this:

(chavez.%,rw-)(%.chem,r--)(%.%,---)  bronze

This example shows the format an ACL takes under HP-UX. Each parenthesized item is known as an access control list entry, although we're going to call them "entries." The percent sign character ("%") is a wildcard within an entry, and the three entries in the previous listing specify the access for user chavez as a member of any group, for any user in group chem, and for all other users and groups, respectively.

A file can have up to 16 access control list entries: three base entries corresponding to normal file modes and up to 13 optional entries. Here is the access control list for another file (generated this time by lsacl -l):

silver:
rwx chavez.%
r-x %.chem
r-x %.phys
r-x hill.bio
rwx harvey.%
--- %.%

This ACL grants every access to user chavez with any current group membership (she is the file owner). It grants read and execute access to members of the chem and phys groups; it grants read and execute access to user hill, if hill is a member of group bio; it grants user harvey read, write, and execute access regardless of his group membership; and it grants no access to any other user or group.

Entries within an HP-UX access control list are examined in order of decreasing specificity: entries with a specific user and group are considered first; those with only a specific user follow; ones with only a specific group are next; and the other entries are last of all. Within a class, entries are examined in order. When determining whether or not to permit file access, the first applicable entry is used. Thus, user harvey will be given write access to the file silver even if he is a member of the chem or phys group.

The chacl command is used to modify the access control list for a file. ACLS can be specified to chacl in two distinct forms: as a list of entries or via a chmod-like syntax. By default, chacl adds entries to the current ACL. For example, these two commands add to the file server's ACL read access for the bio group and read and execute access for user hill:

$ chacl "(%.bio,r--) (hill.%,r-x)" silver
$ chacl "%.bio = r, hill.% = rx" silver

In either format, the access control list must be passed to chacl as a single argument. The second format also includes + and - operators as in chmod. For example, this command adds read access for group chem and user harvey, and removes write access for group chem, adding or modifying ACL entries as needed:

$ chacl "%.chem -w+r, harvey.% +r" silver

chacl's -r option can be used to replace the current ACL:

$ chacl -r "@.% = 7, %.@ = rx, %.bio = r, %.% = " *.dat

The @ sign is a shorthand for the current user or group owner as appropriate, and also enables user-independent ACLS to be constructed. chacl's -f option can be used to copy an ACL from one file to another file or group of files. This command applies the ACL from the file silver to all files in the current directory having the extension .dat :

$ chacl -f silver *.dat

Be careful with this option as it will change the ownership of target files if necessary so that the ACL exactly matches that of the specified file. If you merely want to apply a standard ACL to a set of files, you're better off creating a file containing the desired ACL, using @ characters as appropriate, and then applying it to files in this way:

$ chacl -r `cat acl.metal` *.dat

You can create the initial template file by using lsacl on an existing file and capturing the output.

You can still use chmod to change the base entries of a file with an ACL if you include the -A option. Files with optional entries are marked by a plus sign appended to the mode string in long directory listings:

-rw-------+  1 chavez   chem        8684 Jun 20 16:08 has_one
-rw-r--r--   1 chavez   chem      648205 Jun 20 11:12 none_here