security.nfs4

NFSv4 access-control-list types.

Types

Type	Description
Ace	Immutable NFSv4 access-control entry.
Acl	Immutable NFSv4 access-control list.
Flags	NFSv4 ACE inheritance and audit flags.
Mask	NFSv4 ACE permission bits.
AceSpec	An NFSv4 entry, built or declared as a dictionary. A dictionary has exactly one type key, with the same meaning as the keyword arguments of ace.
AceType	The type of an entry.
AclSpec	An NFSv4 ACL, built or given as its entries.
FlagBit	A symbol naming a flag of a Flags.
FlagsSpec	Flags given as Flags, one symbol, or an iterable of symbols.
MaskBit	A symbol naming a bit of a Mask.
MaskSpec	A mask given as a Mask, one symbol, or an iterable of symbols.
Principal	The principal of an entry: the file owner, owning group, everyone, or a user or group ID.

AceSpec = (Ace | Dict[{allow: Principal, mask: MaskSpec, ?flags: FlagsSpec}] | Dict[{deny: Principal, mask: MaskSpec, ?flags: FlagsSpec}] | Dict[{audit: Principal, mask: MaskSpec, ?flags: FlagsSpec}] | Dict[{alarm: Principal, mask: MaskSpec, ?flags: FlagsSpec}])

An NFSv4 entry, built or declared as a dictionary. A dictionary has exactly one type key, with the same meaning as the keyword arguments of ace.

AceType = (:ALLOW: | :DENY: | :AUDIT: | :ALARM:)

The type of an entry.

AclSpec = (Acl | Iterable[AceSpec])

An NFSv4 ACL, built or given as its entries.

FlagBit = (:FILE_INHERIT: | :DIRECTORY_INHERIT: | :NO_PROPAGATE_INHERIT: | :INHERIT_ONLY: | :SUCCESSFUL_ACCESS: | :FAILED_ACCESS: | :INHERITED:)

A symbol naming a flag of a Flags.

Symbol	Meaning
:FILE_INHERIT:	Files created within a directory inherit this entry
:DIRECTORY_INHERIT:	Subdirectories created within a directory inherit this entry
:NO_PROPAGATE_INHERIT:	Stop propagating this entry after one level of inheritance
:INHERIT_ONLY:	This entry is inherited but does not apply to the directory itself
:SUCCESSFUL_ACCESS:	Generate an audit/alarm event on successful access (:AUDIT:/:ALARM: entries)
:FAILED_ACCESS:	Generate an audit/alarm event on failed access (:AUDIT:/:ALARM: entries)
:INHERITED:	This entry was inherited from a parent directory

FlagsSpec = (Flags | FlagBit | Iterable[FlagBit])

Flags given as Flags, one symbol, or an iterable of symbols.

MaskBit = (:READ_DATA: | :WRITE_DATA: | :APPEND_DATA: | :READ_NAMED_ATTRS: | :WRITE_NAMED_ATTRS: | :EXECUTE: | :DELETE_CHILD: | :READ_ATTRIBUTES: | :WRITE_ATTRIBUTES: | :DELETE: | :READ_ACL: | :WRITE_ACL: | :WRITE_OWNER: | :SYNCHRONIZE:)

A symbol naming a bit of a Mask.

Symbol	Meaning
:READ_DATA:	Read the file's data, or list a directory
:WRITE_DATA:	Write the file's data, or create a file in a directory
:APPEND_DATA:	Append to the file's data, or create a subdirectory
:READ_NAMED_ATTRS:	Read named attributes
:WRITE_NAMED_ATTRS:	Write named attributes
:EXECUTE:	Execute the file, or traverse a directory
:DELETE_CHILD:	Delete a file or directory within a directory
:READ_ATTRIBUTES:	Read basic attributes
:WRITE_ATTRIBUTES:	Write basic attributes
:DELETE:	Delete the file or directory
:READ_ACL:	Read the ACL
:WRITE_ACL:	Write the ACL
:WRITE_OWNER:	Change owner and owning group
:SYNCHRONIZE:	Use synchronous I/O

MaskSpec = (Mask | MaskBit | Iterable[MaskBit])

A mask given as a Mask, one symbol, or an iterable of symbols.

Principal = (:OWNER: | :OWNING_GROUP: | :EVERYONE: | Dict[{user: Int}] | Dict[{group: Int}])

The principal of an entry: the file owner, owning group, everyone, or a user or group ID.

Functions

ace :mask … -> Ace

Constructs an NFSv4 entry from declarative arguments.

Pass exactly one type key. Masks and flags accept their built type, one symbol, or an iterable of symbols.

Parameters

Name	Type	Description
:allow?	Principal	Principal for an :ALLOW: entry.
:deny?	Principal	Principal for a :DENY: entry.
:audit?	Principal	Principal for an :AUDIT: entry.
:alarm?	Principal	Principal for an :ALARM: entry.
:mask	MaskSpec	Permission mask.
:flags?	FlagsSpec	Inheritance/audit flags. Defaults to empty.

Example

ace allow: :OWNER: mask: [:READ_DATA:, :READ_ACL:]
ace deny: {user: 1000} mask: :WRITE_DATA:

acl *aces -> Acl

Constructs an NFSv4 ACL from entries and declarative entry dictionaries.

An empty ACL is valid.

Parameters

Name	Type	Description
*aces	AceSpec	Entries, spread with ... to pass a collection.