ARCHIVE_ENTRY_ACL(3)

📦 version 15.1, in freebsd 14.5, freebsd 15.1

💖 ARCHIVE_ENTRY_ACL(3) 💖

okay bestie, sit down, hydrate, because we're talking about archive_entry_acl — that's the ARCHIVE_ENTRY_ACL(3) manual page, and it is lowkey a whole personality. This is the family of functions that lets you mess with Access Control Lists inside archive entry descriptions. ACLs, iykyk — the fancy permission lists that go way beyond your basic rwx. This page is long so we're doing it in parts, and part one is right here, bestie 🫶

✨ NAME ✨

archive_entry_acl_add_entry, archive_entry_acl_add_entry_w, archive_entry_acl_clear, archive_entry_acl_count, archive_entry_acl_from_text, archive_entry_acl_from_text_w, archive_entry_acl_next, archive_entry_acl_reset, archive_entry_acl_to_text, archive_entry_acl_to_text_w, archive_entry_acl_types — functions for manipulating Access Control Lists in archive entry descriptions. slay 💅

📚 LIBRARY 📚

Streaming Archive Library (libarchive, -larchive) 🦋

🌸 SYNOPSIS 🌸

like, here's the whole squad, exact vibes only:

#include <archive_entry.h>

void
archive_entry_acl_add_entry(struct archive_entry *a, int type,
    int permset, int tag, int qualifier, const char *name);

void
archive_entry_acl_add_entry_w(struct archive_entry *a, int type,
    int permset, int tag, int qualifier, const wchar_t *name);

void
archive_entry_acl_clear(struct archive_entry *a);

int
archive_entry_acl_count(struct archive_entry *a, int type);

int
archive_entry_acl_from_text(struct archive_entry *a, const char *text,
    int type);

int
archive_entry_acl_from_text_w(struct archive_entry *a,
    const wchar_t *text, int type);

int
archive_entry_acl_next(struct archive_entry *a, int type, int *ret_type,
    int *ret_permset, int *ret_tag, int *ret_qual,
    const char **ret_name);

int
archive_entry_acl_reset(struct archive_entry *a, int type);

char *
archive_entry_acl_to_text(struct archive_entry *a, ssize_t *len_p,
    int flags);

wchar_t *
archive_entry_acl_to_text_w(struct archive_entry *a, ssize_t *len_p,
    int flags);

int
archive_entry_acl_types(struct archive_entry *a);

twelve functions, one header, zero chill. the _w ones are the wide-character girlies, the rest are your everyday char crew. periodt ✨

more parts incoming bestie, don't go anywhere 💜

✨ DESCRIPTION ✨

okay so bestie, “Access Control Lists (ACLs)” extend the standard Unix permission model. The ACL interface of libarchive supports both POSIX.1e and NFSv4 style ACLs. Use of ACLs is restricted by various levels of ACL support in operating systems, file systems and archive formats. lowkey important, fr fr.

🌸 POSIX.1e Access Control Lists 🌸

A POSIX.1e ACL consists of a number of independent entries. Each entry specifies the permission set as a bitmask of basic permissions. Valid permissions in the permset are literally:

  • ARCHIVE_ENTRY_ACL_READ (r)
  • ARCHIVE_ENTRY_ACL_WRITE (w)
  • ARCHIVE_ENTRY_ACL_EXECUTE (x)

The permissions correspond to the normal Unix permissions. periodt.

The tag specifies the principal to which the permission applies. Valid values are:

  • ARCHIVE_ENTRY_ACL_USER — The user specified by the name field.
  • ARCHIVE_ENTRY_ACL_USER_OBJ — The owner of the file.
  • ARCHIVE_ENTRY_ACL_GROUP — The group specified by the name field.
  • ARCHIVE_ENTRY_ACL_GROUP_OBJ — The group which owns the file.
  • ARCHIVE_ENTRY_ACL_MASK — The maximum permissions to be obtained via group permissions.
  • ARCHIVE_ENTRY_ACL_OTHER — Any principal who is not the file owner or a member of the owning group.

The principals ARCHIVE_ENTRY_ACL_USER_OBJ, ARCHIVE_ENTRY_ACL_GROUP_OBJ and ARCHIVE_ENTRY_ACL_OTHER are equivalent to user, group and other in the classic Unix permission model and specify non-extended ACL entries. it's giving classic.

All files have an access ACL (ARCHIVE_ENTRY_ACL_TYPE_ACCESS). This specifies the permissions required for access to the file itself. Directories have an additional ACL (ARCHIVE_ENTRY_ACL_TYPE_DEFAULT), which controls the initial access ACL for newly-created directory entries. slay.

🦋 NFSv4 Access Control Lists 🦋

A NFSv4 ACL consists of multiple individual entries called Access Control Entries (ACEs). no cap.

There are four possible types of a NFSv4 ACE:

  • ARCHIVE_ENTRY_ACL_TYPE_ALLOW — Allow principal to perform actions requiring given permissions.
  • ARCHIVE_ENTRY_ACL_TYPE_DENY — Prevent principal from performing actions requiring given permissions.
  • ARCHIVE_ENTRY_ACL_TYPE_AUDIT — Log access attempts by principal which require given permissions.
  • ARCHIVE_ENTRY_ACL_TYPE_ALARM — Trigger a system alarm on access attempts by principal which require given permissions.

The tag specifies the principal to which the permission applies. Valid values are:

  • ARCHIVE_ENTRY_ACL_USER — The user specified by the name field.
  • ARCHIVE_ENTRY_ACL_USER_OBJ — The owner of the file.
  • ARCHIVE_ENTRY_ACL_GROUP — The group specified by the name field.
  • ARCHIVE_ENTRY_ACL_GROUP_OBJ — The group which owns the file.
  • ARCHIVE_ENTRY_ACL_EVERYONE — Any principal who is not the file owner or a member of the owning group.

Entries with the ARCHIVE_ENTRY_ACL_USER or ARCHIVE_ENTRY_ACL_GROUP tag store the user and group name in the name string and optionally the user or group ID in the qualifier integer.

NFSv4 ACE permissions and flags are stored in the same permset bitfield. Some permissions share the same constant and permission character but have different effect on directories than on files. The following ACE permissions are supported:

  • ARCHIVE_ENTRY_ACL_READ_DATA (r) — Read data (file).
  • ARCHIVE_ENTRY_ACL_LIST_DIRECTORY (r) — List entries (directory).
  • ARCHIVE_ENTRY_ACL_WRITE_DATA (w) — Write data (file).
  • ARCHIVE_ENTRY_ACL_ADD_FILE (w) — Create files (directory).
  • ARCHIVE_ENTRY_ACL_EXECUTE (x) — Execute file or change into a directory.
  • ARCHIVE_ENTRY_ACL_APPEND_DATA (p) — Append data (file).
  • ARCHIVE_ENTRY_ACL_ADD_SUBDIRECTORY (p) — Create subdirectories (directory).
  • ARCHIVE_ENTRY_ACL_DELETE_CHILD (D) — Remove files and subdirectories inside a directory.
  • ARCHIVE_ENTRY_ACL_DELETE (d) — Remove file or directory.
  • ARCHIVE_ENTRY_ACL_READ_ATTRIBUTES (a) — Read file or directory attributes.
  • ARCHIVE_ENTRY_ACL_WRITE_ATTRIBUTES (A) — Write file or directory attributes.
  • ARCHIVE_ENTRY_ACL_READ_NAMED_ATTRS (R) — Read named file or directory attributes.
  • ARCHIVE_ENTRY_ACL_WRITE_NAMED_ATTRS (W) — Write named file or directory attributes.
  • ARCHIVE_ENTRY_ACL_READ_ACL (c) — Read file or directory ACL.
  • ARCHIVE_ENTRY_ACL_WRITE_ACL (C) — Write file or directory ACL.
  • ARCHIVE_ENTRY_ACL_WRITE_OWNER (o) — Change owner of a file or directory.
  • ARCHIVE_ENTRY_ACL_SYNCHRONIZE (s) — Use synchronous I/O.

The following NFSv4 ACL inheritance flags are supported:

  • ARCHIVE_ENTRY_ACL_ENTRY_FILE_INHERIT (f) — Inherit parent directory ACE to files.
  • ARCHIVE_ENTRY_ACL_ENTRY_DIRECTORY_INHERIT (d) — Inherit parent directory ACE to subdirectories.
  • ARCHIVE_ENTRY_ACL_ENTRY_INHERIT_ONLY (i) — Only inherit, do not apply the permission on the directory itself.
  • ARCHIVE_ENTRY_ACL_ENTRY_NO_PROPAGATE_INHERIT (n) — Do not propagate inherit flags. Only first-level entries inherit ACLs.
  • ARCHIVE_ENTRY_ACL_ENTRY_SUCCESSFUL_ACCESS (S) — Trigger alarm or audit on successful access.
  • ARCHIVE_ENTRY_ACL_ENTRY_FAILED_ACCESS (F) — Trigger alarm or audit on failed access.
  • ARCHIVE_ENTRY_ACL_ENTRY_INHERITED (I) — Mark that ACE was inherited.

💅 Functions 💅

archive_entry_acl_add_entry() and archive_entry_acl_add_entry_w() add a single ACL entry. For the access ACL and non-extended principals, the classic Unix permissions are updated. An archive entry cannot contain both POSIX.1e and NFSv4 ACL entries. 💀

archive_entry_acl_clear() removes all ACL entries and resets the enumeration pointer.

archive_entry_acl_count() counts the ACL entries that have the given type mask. type can be the bitwise-or of

  • ARCHIVE_ENTRY_ACL_TYPE_ACCESS
  • ARCHIVE_ENTRY_ACL_TYPE_DEFAULT

for POSIX.1e ACLs and

  • ARCHIVE_ENTRY_ACL_TYPE_ALLOW
  • ARCHIVE_ENTRY_ACL_TYPE_DENY
  • ARCHIVE_ENTRY_ACL_TYPE_AUDIT
  • ARCHIVE_ENTRY_ACL_TYPE_ALARM

for NFSv4 ACLs. For POSIX.1e ACLs if ARCHIVE_ENTRY_ACL_TYPE_ACCESS is included and at least one extended ACL entry is found, the three non-extended ACLs are added.

archive_entry_acl_from_text() and archive_entry_acl_from_text_w() add new (or merge with existing) ACL entries from (wide) text. The argument type may take one of the following values:

  • ARCHIVE_ENTRY_ACL_TYPE_ACCESS
  • ARCHIVE_ENTRY_ACL_TYPE_DEFAULT
  • ARCHIVE_ENTRY_ACL_TYPE_NFS4

Supports all formats that can be created with archive_entry_acl_to_text() or respectively archive_entry_acl_to_text_w(). Existing ACL entries are preserved. To get a clean new ACL from text archive_entry_acl_clear() must be called first. Entries prefixed with “default:” are treated as ARCHIVE_ENTRY_ACL_TYPE_DEFAULT unless type is ARCHIVE_ENTRY_ACL_TYPE_NFS4. Invalid entries, non-parseable ACL entries and entries beginning with the ‘#’ character (comments) are skipped.

archive_entry_acl_next() return the next entry of the ACL list. This functions may only be called after archive_entry_acl_reset() has indicated the presence of extended ACL entries.

archive_entry_acl_reset() prepare reading the list of ACL entries with archive_entry_acl_next(). The function returns 0 if no non-extended ACLs are found. In this case, the access permissions should be obtained by archive_entry_mode(3) or set using chmod(2). Otherwise, the function returns the same value as archive_entry_acl_count().

archive_entry_acl_to_text() and archive_entry_acl_to_text_w() convert the ACL entries for the given type into a (wide) string of ACL entries separated by newline. If the pointer len_p is not NULL, then the function shall return the length of the string (not including the NULL terminator) in the location pointed to by len_p. The flag argument is a bitwise-or.

The following flags are effective only on POSIX.1e ACL:

  • ARCHIVE_ENTRY_ACL_TYPE_ACCESS — Output access ACLs.
  • ARCHIVE_ENTRY_ACL_TYPE_DEFAULT — Output POSIX.1e default ACLs.
  • ARCHIVE_ENTRY_ACL_STYLE_MARK_DEFAULT — Prefix each default ACL entry with the word “default:”.
  • ARCHIVE_ENTRY_ACL_STYLE_SOLARIS — The mask and other ACLs don not contain a double colon.

The following flags are effective only on NFSv4 ACL:

  • ARCHIVE_ENTRY_ACL_STYLE_COMPACT — Do not output minus characters for unset permissions and flags in NFSv4 ACL permission and flag fields.

The following flags are effective on both POSIX.1e and NFSv4 ACL:

  • ARCHIVE_ENTRY_ACL_STYLE_EXTRA_ID — Add an additional colon-separated field containing the user or group id.
  • ARCHIVE_ENTRY_ACL_STYLE_SEPARATOR_COMMA — Separate ACL entries with comma instead of newline.

If the archive entry contains NFSv4 ACLs, all types of NFSv4 ACLs are returned. It the entry contains POSIX.1e ACLs and none of the flags ARCHIVE_ENTRY_ACL_TYPE_ACCESS or ARCHIVE_ENTRY_ACL_TYPE_DEFAULT are specified, both access and default entries are returned and default entries are prefixed with “default:”.

archive_entry_acl_types() get ACL entry types contained in an archive entry's ACL. As POSIX.1e and NFSv4 ACL entries cannot be mixed, this function is a very efficient way to detect if an ACL already contains POSIX.1e or NFSv4 ACL entries.

✨ RETURN VALUES ✨

okay bestie, here's the part where we find out what you actually get back, because every function in this family has opinions 💅

  • archive_entry_acl_count() and archive_entry_acl_reset() — these two return the number of ACL entries that match the given type mask. and here's the lil plot twist: for POSIX.1e ACLs, if the type mask includes ARCHIVE_ENTRY_ACL_TYPE_ACCESS and at least one extended ACL entry exists, the three classic Unix permissions get counted too. so like, they're not just sitting on the sidelines, they're on the roster 🫶
  • archive_entry_acl_from_text() and archive_entry_acl_from_text_w() — these return ARCHIVE_OK if every single entry was successfully parsed. but if one or more entries were invalid or just straight-up non-parseable, you get ARCHIVE_WARN instead. so it's giving "mostly fine but read the room" energy 😭
  • archive_entry_acl_next() — returns ARCHIVE_OK on success, ARCHIVE_EOF when there are no more ACL entries left (we love a clean ending), and ARCHIVE_WARN if you never called archive_entry_acl_reset() first. yeah. that one's on you bestie 🙈
  • archive_entry_acl_to_text() — returns a string representing the ACL entries matching the given type and flags on success, or NULL on error. iconic when it works, devastating when it doesn't 💀
  • archive_entry_acl_to_text_w() — same deal but make it wide: returns a wide string representing the ACL entries matching the given type and flags on success, or NULL on error. she's the wide-character sister, no cap ✨
  • archive_entry_acl_types() — returns a bitmask of ACL entry types, or 0 if the archive entry has no ACL entries at all. zero. nothing. empty. the void 🌸
fr fr, watch those ARCHIVE_WARN returns — they're not full-on failures, they're lil "hey, something was off" notes, and if you ignore them you're gonna have a bad time 🎀

🌈 SEE ALSO 🌈

go read those next bestie, they're the whole vibe, iykyk 💖

and that's the whole page, we ate and left no crumbs 👑

this lil masterpiece came from the Debian crew, dated February 15, 2017, and it lives in section 3 as ARCHIVE_ENTRY_ACL(3) — periodt 💅🦋⭐

📦 where this page comes from