ACL permissions are determined by a match to a single ACL entry, not to an accumulation of matching entries.
Checking is done from the most restrictive entry types to the broadest.
If a match is found in a user entry type, no further
checking is done, and the permissions for that user are fully defined
by the permissions field of the matched entry. A matched user may
be a member of a group with broader permissions; this has no consequence.
 |
| |
|
 | NOTE: The local superuser has access to all local SD-UX
objects irrespective of ACLs. |
|
| |
|
The ACL matching algorithm is:
If user is local superuser, then grant all permissions.
If user is owner of the
object, then grant object_owner permissions.
If user matches a user entry, then grant user permissions.
If any group entries match, then accumulate the permissions
granted by all group entries that match the user’s
primary and supplementary groups.
If an appropriate other entry matches, then grant other permissions.
If an any_other entry, then grant any_other permissions.
Grant no permissions.
Printable version
