Chapter 11: Extended Attributes and Access Control Lists
Otherwise, both implementations are nearly identical; for most functions described above, a variant with
the prefixext3_replaced withext2_is available.11.2 Access Control Lists
POSIX access control lists (ACLs) are an extension specified in a POSIX standard to make the DAC model
of Linux finer grained. As usual, I assume that you have some familiarity with the concept, but a very
good overview is provided in the manual pageacl(5).^3 ACLs are implemented on top of extended
attributes and modified with the same methods as other extended attributes are. In comparison to other
xattrs whose contents are of no interest to the kernel, ACL xattrs are integrated into the inode permission
checks. Although filesystems are free to choose a physical format to represent extended attributes, the
kernel nevertheless defines a conversation structure to represent an access control list. The following
namespaces must be used for extended attributes that carry access control lists:<posix_acl_xattr.h>
#define POSIX_ACL_XATTR_ACCESS "system.posix_acl_access"
#define POSIX_ACL_XATTR_DEFAULT "system.posix_acl_default"The userland programsgetfacl,setfacl,andchaclare used to get, set, and change the contents of
an ACL. They use the standard system calls to manipulate extended attributes and do not require any
non-standard interaction with the kernel. Many other utilities, for instance,ls, also have built-in support
for dealing with access control lists.11.2.1 Generic Implementation
The generic code for the implementation of ACLs is contained in two files:fs/posix_acl.ccontains
code to allocate new ACLs, clone ACLs, perform extended permission checks, and so on; while
fs/xattr_acl.cholds functions to convert between extended attributes and the generic representation
of ACLs, and vice versa. All generic data structures are defined ininclude/linux/posix_acl.hand
include/linux/posix_acl_xattr.h.Data Structures
The central data structure for in-memory representation that holds all data associated with an ACL is
defined as follows:<posix_acl.h>
struct posix_acl_entry {
short e_tag;
unsigned short e_perm;
unsigned int e_id;
};struct posix_acl {
atomic_t a_refcount;(^3) Note that another good overview about ACLs in general and the status of the implementation in various filesystems supported by
Linux is given in the Usenix paper of Andreas Gr ̈unbacher [Gr ̈u03], one of the principal authors of ACL support for the Ext2 and
Ext3 filesystems.