GENFS_CAN_ACCESS_ACL_POSIX1E(9)

💅 NAME 💅

okay so bestie, genfs_can_access_acl_posix1e — that's a Kernel Developer's Manual page btw, we're in the big leagues — is literally the function that generates a POSIX.1e ACL access control decision using vnode parameters. no cap, that's the whole vibe. ✨

---

🌸 SYNOPSIS 🌸

#include <miscfs/genfs/genfs.h>

int
genfs_can_access_acl_posix1e(struct vnode *vp, kauth_cred_t cred,
    uid_t file_uid, gid_t file_gid, mode_t file_mode, struct acl *acl,
    accmode_t accmode);

---

🎀 DESCRIPTION 🎀

so this call right here? it implements the logic for the Unix discretionary file security model with POSIX.1e ACL extensions. it's giving very main character security energy. 🫶

it takes in the vnode vp, the requesting credential cred, the owning UID file_uid, the owning GID file_gid, the file permissions file_mode, the access ACL for the file acl, and the desired access mode accmode. that's the whole guest list, bestie. ✨

this call is intended to support implementations of VOP_ACCESS(9) — those will use their own access methods to grab the vnode properties, then invoke genfs_can_access_acl_posix1e() to do the actual check. like, they do the fetching, this function does the judging. 💅

implementations of VOP_ACCESS(9) may also choose to implement additional security mechanisms, and their results will be composed with the return value. so extra layers of security, iconic of them honestly. 🔥

the algorithm used by genfs_can_access_acl_posix1e() is based on the POSIX.1e ACL evaluation algorithm. it selects a matching entry from the access ACL, which may then be composed with an available ACL mask entry, providing Unix security compatibility. the way that it matches entries and then composes with the mask?? obsessed. 😭

once the appropriate protections are selected for the current credential, the requested access mode — combined with the vnode type — gets compared with the discretionary rights available for the credential. and if those discretionary protections aren't giving enough? super-user privilege, if it's available for the credential, will also be considered. like a backup bestie stepping in. 👑

---

⭐ RETURN VALUES ⭐

genfs_can_access_acl_posix1e() will return 0 on success, or a non-zero error value on failure. slay (when it succeeds). 💖

---

🦋 ERRORS 🦋

• [EACCES] — Permission denied. someone tried to access a file in a way that's forbidden by its file access permissions. rude. 😤
• [EPERM] — Operation not permitted. an attempt was made to perform an operation that's limited to processes with appropriate privileges, or to the owner of a file or other resource. read the room, honestly.

---

🌈 SEE ALSO 🌈

genfs_can_access(9), vnode(9), VOP_ACCESS(9)

the little squad of related pages, iykyk. 🧚

---

👑 AUTHORS 👑

this manual page and the current implementation of genfs_can_access_acl_posix1e() were written by Robert Watson. an absolute legend, fr fr. 🎀

---

💀 BUGS 💀

ngl, this manual page should include a full description of the POSIX.1e ACL evaluation algorithm, or cross reference another page that does. it's a known gap — not me pointing it out or anything, it's literally in the page. 🙈

---

okay that's the whole thing bestie, you're officially an ACL girlie now. 💜 this page comes from the Debian project, dated January 17, 2022 — GENFS_CAN_ACCESS_ACL_POSIX1E(9), mwah, love u, bye 💋