---
name: "acl_check"
section: "3"
platform: "linux"
package: "acl"
version: "2.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/acl_check"
---

# acl\_check(3)

check an ACL for validity

## NAME

**acl\_check** – check an ACL for validity

## LIBRARY

Linux Access Control Lists library (libacl, -lacl).

## SYNOPSIS

**#include \<sys/types.h\>**

**#include \<acl/libacl.h\>**

*int*\

**acl\_check**(*acl\_t acl*, *int \*last*);

## DESCRIPTION

The **acl\_check**() function checks the ACL referred to by the argument *acl* for validity.

The three required entries ACL\_USER\_OBJ, ACL\_GROUP\_OBJ, and ACL\_OTHER must exist exactly once in the ACL. If the ACL contains any ACL\_USER or ACL\_GROUP entries, then an ACL\_MASK entry is also required. The ACL may contain at most one ACL\_MASK entry.

The user identifiers must be unique among all entries of type ACL\_USER. The group identifiers must be unique among all entries of type ACL\_GROUP.

If the ACL referred to by *acl* is invalid, **acl\_check**() returns a positive error code that indicates which type of error was detected. The following symbolic error codes are defined:

- ACL\_MULTI\_ERROR

  The ACL contains multiple entries that have a tag type that may occur at most once.

- ACL\_DUPLICATE\_ERROR

  The ACL contains multiple ACL\_USER entries with the same user ID, or multiple ACL\_GROUP entries with the same group ID.

- ACL\_MISS\_ERROR

  A required entry is missing.

- ACL\_ENTRY\_ERROR

  The ACL contains an invalid entry tag type.

The **acl\_error**() function can be used to translate error codes to text messages.

In addition, if the pointer *last* is not NULL, **acl\_check**() assigns the number of the ACL entry at which the error was detected to the value pointed to by *last*. Entries are numbered starting with zero, in the order in which they would be returned by the **acl\_get\_entry**() function.

## RETURN VALUE

If successful, the **acl\_check**() function returns 0 if the ACL referred to by *acl* is valid, and a positive error code if the ACL is invalid. Otherwise, a value of -1 is returned and the global variable *errno* is set to indicate the error.

## ERRORS

If any of the following conditions occur, the **acl\_check**() function returns -1 and sets *errno* to the corresponding value:

- \[EINVAL\]

  The argument *acl* is not a valid pointer to an ACL.

## STANDARDS

This is a non-portable, Linux specific extension to the ACL manipulation functions defined in IEEE Std 1003.1e draft 17 (“POSIX.1e”, abandoned).

## SEE ALSO

[acl\_valid(3)](/acl_valid/3.md), [acl(5)](/acl/5.md)

## AUTHOR

Written by Andreas Gruenbacher ⟨andreas.gruenbacher@gmail.com⟩.