1.\"- 2.\" Copyright (c) 2001 Robert N. M. Watson 3.\" All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 1. Redistributions of source code must retain the above copyright 9.\" notice, this list of conditions and the following disclaimer. 10.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 14.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24.\" SUCH DAMAGE. 25.\" 26.Dd September 18, 2009 27.Dt VACCESS_ACL_NFS4 9 28.Os 29.Sh NAME 30.Nm vaccess_acl_nfs4 31.Nd generate a NFSv4 ACL access control decision using vnode parameters 32.Sh SYNOPSIS 33.In sys/param.h 34.In sys/vnode.h 35.In sys/acl.h 36.Ft int 37.Fo vaccess_acl_nfs4 38.Fa "enum vtype type" 39.Fa "uid_t file_uid" 40.Fa "gid_t file_gid" 41.Fa "struct acl *acl" 42.Fa "accmode_t accmode" 43.Fa "struct ucred *cred" 44.Fa "int *privused" 45.Fc 46.Sh DESCRIPTION 47This call implements the logic for the 48.Ux 49discretionary file security model 50with NFSv4 ACL extensions. 51It accepts the vnodes type 52.Fa type , 53owning UID 54.Fa file_uid , 55owning GID 56.Fa file_gid , 57access ACL for the file 58.Fa acl , 59desired access mode 60.Fa accmode , 61requesting credential 62.Fa cred , 63and an optional call-by-reference 64.Vt int 65pointer returning whether or not 66privilege was required for successful evaluation of the call; the 67.Fa privused 68pointer may be set to 69.Dv NULL 70by the caller in order not to be informed of 71privilege information, or it may point to an integer that will be set to 721 if privilege is used, and 0 otherwise. 73.Pp 74This call is intended to support implementations of 75.Xr VOP_ACCESS 9 , 76which will use their own access methods to retrieve the vnode properties, 77and then invoke 78.Fn vaccess_acl_nfs4 79in order to perform the actual check. 80Implementations of 81.Xr VOP_ACCESS 9 82may choose to implement additional security mechanisms whose results will 83be composed with the return value. 84.Pp 85The algorithm used by 86.Fn vaccess_acl_nfs4 87is based on the NFSv4 ACL evaluation algorithm, as described in 88NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-21.txt. 89The algorithm selects a 90.Em matching 91entry from the access ACL, which may 92then be composed with an available ACL mask entry, providing 93.Ux 94security compatibility. 95.Pp 96Once appropriate protections are selected for the current credential, 97the requested access mode, in combination with the vnode type, will be 98compared with the discretionary rights available for the credential. 99If the rights granted by discretionary protections are insufficient, 100then super-user privilege, if available for the credential, will also be 101considered. 102.Sh RETURN VALUES 103.Fn vaccess_acl_nfs4 104will return 0 on success, or a non-zero error value on failure. 105.Sh ERRORS 106.Bl -tag -width Er 107.It Bq Er EACCES 108Permission denied. 109An attempt was made to access a file in a way forbidden by its file access 110permissions. 111.It Bq Er EPERM 112Operation not permitted. 113An attempt was made to perform an operation limited to processes with 114appropriate privileges or to the owner of a file or other resource. 115.El 116.Sh SEE ALSO 117.Xr vaccess 9 , 118.Xr vnode 9 , 119.Xr VOP_ACCESS 9 120.Sh AUTHORS 121Current implementation of 122.Fn vaccess_acl_nfs4 123was written by 124.An Edward Tomasz Napierala Aq Mt trasz@FreeBSD.org . 125.Sh BUGS 126This manual page should include a full description of the NFSv4 ACL 127evaluation algorithm, or cross reference another page that does. 128