MAILDIRACL(1)

💌 MAILDIRACL — okay bestie, let's talk access control lists 💌

Hi hi! This is maildiracl, section 1 of the manual, written by S. Varshavchik, and it's the little tool that manages access control lists for your maildir folders. Strap in, it's giving sysadmin main character energy. ✨

---

🌸 SYNOPSIS 🌸

Like, the shapes it comes in:

maildiracl {-reset} {maildir}

maildiracl {-list} {maildir} {INBOX[.folder]}

maildiracl {-set} {maildir} {INBOX[.folder]} {[-]identifier}
           {[+/-]rights}

maildiracl {-delete} {maildir} {INBOX[.folder]} {[-]identifier}

maildiracl {-compute} {maildir} {INBOX[.folder]} {identifier...}

---

✨ DESCRIPTION ✨

So maildiracl manages "access control lists" (ACLs, bestie, we abbreviate everything) for the Courier IMAP server's maildir folders. And what are ACLs for, you ask? They're used primarily to give you fine-grained control over who can access virtual shared folders via IMAP. No cap. 💅

Note 🫶 The Courier IMAP server server implements two types of shared folders: filesystem permission-based shared folders, and virtual shared folders based on IMAP access control lists. Use the maildiracl command to set up access control lists for virtual shared folders. Use the maildirmake(1)[1] command to implement shared folders based on filesystem permissions. See the Courier IMAP server documentation for additional info on setting up virtual shared folders.

🎀 ACL overview 🎀

ACLs are the fine-grained mechanism for controlling access to shared folders. Lowkey iconic. You can say stuff like: user1 may only open and read messages in the folder, while user2 can also delete messages and create subfolders. Different vibes for different users. 💖

Every single folder maintains its own individual access control list that specifies who can do what to that folder. An ACL is a list of “identifier” and “rights” pairs. Each pair means the entity called “identifier” (using the UTF-8 character set, always) is allowed to do “rights” on this folder.

And “rights” is one or more letters, where each letter is a whole action:

• a — identifier may modify this folder's ACLs. (admin energy 👑)
• c — identifier may create subfolders of this folder. This includes renaming another folder as this folder's subfolders, fr fr.
• e — identifier may remove deleted messages from this folder. (expunge, bestie ✨)
• i — identifier may add messages to this folder, whether that's uploading them one by one or copying messages from another folder.
• l — identifier may actually see that this folder exists. Like, look right at it. If identifier doesn't have the “l” right on this folder, the folder is effectively invisible to them. Ghosted. 👻
• r — identifier may open this folder. Careful though: if identifier knows the name of this folder, it can open it even without the “l” right on it. Sneaky. 🙈
• s — identifier may mark messages in this folder as seen, or unseen.
• t — identifier may mark messages in this folder as deleted, or undeleted.
• w — identifier may change other status flags of messages in this folder. May also add or remove custom keywords on individual messages.
• x — identifier may delete this folder, which includes renaming this folder as another mailbox's subfoler.

💀 Negative rights 💀

An ACL entry of “-identifier” and “rights” is called a “negative right”, and what it does is explicitly remove “rights” from “identifier”. Usually more than one “identifier” gets used to figure out the actual rights someone has on a given folder. The actual access rights = take all the rights from all applicable identifiers, then subtract any negative rights, as explained in the next bit. Periodt.

🧚 Identifiers 🧚

Access rights on a given folder are computed by obtaining the rights on the following identifiers, then subtracting the negative rights on those same identifiers:

• owner — the owner of the maildir containing this folder. The maildir's INBOX's ACL defaults to all rights for its owner. A new folder's ACL is the same as its parent's ACL. And in all cases, trying to remove the “a” right from the owner — either directly or using a negative right — results in an error. Don't even try it. 😭
• anyone — this identifier refers literally to every userid. Ever. The associated rights (or negative rights) are always used.
• anonymous — this is a synonym for “anyone”.
• user=loginid — rights (or negative rights) for the IMAP account “loginid”.

Note 📝 “loginid” is what's logged to syslog after a succesful login. In some situations “loginid” is not exactly the actual login ID used by the IMAP client. Just so u know.

• group=name — rights (or negative rights) for account group “name”. Access rights get granted to an account group as a whole. The account options feature of the Courier Authentication Library specifies which account belongs to which account group. See courier-authlib's documentation for more info.
• administrators — this is an alias for “group=administrators”. Accounts that are members of an account group called “administrators” are considered administrative accounts, and automatically receive all access rights on all accessible folders. The ultimate power move. 👑

Consider the following access control list:

owner          aceilrstwx
anyone         lr
user=john      w
-user=mary     r
administrators aceilrstwx

This access control list specifies that the folder's owner has complete control over the mailbox (as do the administrators, who have complete access to every folder); everyone else can see it and open it — except for “mary”, who can see that the mailbox exists but can't open it; and additionally “john” can change the status and keywords of individual messages, but not mark them as deleted/undeleted or seen/unseen, because that needs extra rights. Sucks to be john, tbh. 💀

---

💅 OPTIONS 💅

maildiracl -reset maildir

This command resets access control lists in maildir, which is a path to a maildir. Under certain conditions, the files where a folder's ACLs are saved may keep existing even after the folder is removed. Weird, right? The -reset option goes through maildir and removes all those stale ACL files for removed folders. Cleanup era. 🧹✨

Note 🫶 The Courier IMAP server normally performs this maintenance function automatically. It is not necessary to run this command under normal conditions. So like, chill.

maildiracl -list maildir folder

This command lists the access control lists set for folder. And folder must be either “INBOX” or “INBOX.folder.subfolder”, which is the same naming convention the Courier IMAP server uses. Keep it consistent bestie.

maildiracl -set maildir folder identifier rights

Puts identifier (which may begin with a minus sign to specify a negative right) and rights in folder's access control list. Existing rights for identifier (or identifier) get replaced by rights — unless “rights” begins with “+” or “-”, in which case it modifies the existing rights by adding or removing from them accordingly.

Some examples for u:

maildiracl -set /home/user1/Maildir INBOX.Sent user=john lr

maildiracl -set /home/user2/Maildir INBOX.Notes anyone -r

maildiracl -set /home/user3/Maildir INBOX.Private -user=tom +r

Note 👀 Observe that the last command revokes the “r” right from “tom”, by adding it as a negative right. Sneaky but correct.

maildiracl -delete maildir folder identifier

This command removes identifier from folder's access control list, if it exists. Use “-identifier” to remove negative rights.

maildiracl -compute maildir folder [identifier]+

This command takes a list of one or more identifiers. All access rights for the identifiers get combined together, then any appropriate negative rights are removed, and the result is printed on standard output. Slay.

Use the following procedure to compute access rights the exact same way the Courier IMAP server computes them:

maildiracl -compute /home/tom46/Maildir INBOX.Sent owner user=tom46

This command computes the access rights “tom46” has on his own folder.

maildiracl -compute /home/john34/Maildir INBOX.Public user=tom46

This command computes the access rights “tom46” has on “john34”'s folder. Nosy but legal. 🙈

---

🔒 IRREVOCABLE ACCESS RIGHTS 🔒

The owner of the mailbox must always have the “a” and “l” access rights. The administrators group must always have all access rights to all folders. Attempts to set access control lists that don't include these minimum access rights will be rejected. Non-negotiable, bestie.

---

💀 BUGS 💀

• All identifiers are specified using the UTF-8 character set.
• All non-Latin letters in folder names are specified using the modified-UTF7 coding as used in IMAP.
• This implementation of access control lists is based on version 2 (or “ACL2”) of IMAP access control lists, which is a work-in-progress. The existing IMAP ACL, RFC 2086[2], is transparently implemented inside the ACL2 model.
• If history's of any guidance, ACL2 is subject to change at any time. Be sure to check the release notes when upgrading to a newer version of this software. The “ACL overview” portion of this manual page is a very brief summary of ACL2, which leaves out optional parts of ACL2 that are not implemented. So like, don't @ me.

---

🌈 SEE ALSO 🌈

maildirmake(1)[1], maildirkw(1)[3]

---

👑 AUTHOR 👑

Sam Varshavchik

• Author

---

📚 NOTES 📚

1. maildirmake(1) http://www.courier-mta.org/maildirmake.html
2. RFC 2086 http://www.rfc-editor.org/rfc/rfc2086.txt
3. maildirkw(1) http://www.courier-mta.org/maildirkw.html

---

And that's the whole thing, bestie 🎀 this page came from Courier Mail Server and it's dated 01/10/2026. Go forth and ACL responsibly. 💖✨🦋