---
name: "kacl_check"
section: "3"
platform: "linux"
package: "kerberos4kth-dev"
version: "1.2.2-11.2"
release: "Debian 3.1 (Sarge)"
platforms: ["linux"]
url: "https://new.carta.tech/kacl_check"
---

# kacl\_check(3)

Access control list routines

## NAME

acl\_canonicalize\_principal, acl\_check, acl\_exact\_match, acl\_add, acl\_delete, acl\_initialize - Access control list routines

## SYNOPSIS

```
cc <files> -lacl -lkrb
```

**#include \<krb.h\>**

**acl\_canonicalize\_principal(principal, buf)** **char \*principal;** **char \*buf;**

**acl\_check(acl, principal)** **char \*acl;** **char \*principal;**

**acl\_exact\_match(acl, principal)** **char \*acl;** **char \*principal;**

**acl\_add(acl, principal)** **char \*acl;** **char \*principal;**

**acl\_delete(acl, principal)** **char \*acl;** **char \*principal;**

**acl\_initialize(acl\_file, mode)** **char \*acl\_file;** **int mode;**

## DESCRIPTION

### Introduction

An access control list (ACL) is a list of principals, where each principal is represented by a text string which cannot contain whitespace.  The library allows application programs to refer to named access control lists to test membership and to atomically add and delete principals using a natural and intuitive interface.  At present, the names of access control lists are required to be Unix filenames, and refer to human-readable Unix files; in the future, when a networked ACL server is implemented, the names may refer to a different namespace specific to the ACL service.

### Principal Names

Principal names have the form

```
<name>[.<instance>][@<realm>]
e.g.:
asp
asp.root
asp@ATHENA.MIT.EDU
asp.@ATHENA.MIT.EDU
asp.root@ATHENA.MIT.EDU
```

It is possible for principals to be underspecified.  If an instance is missing, it is assumed to be "".  If realm is missing, it is assumed to be the local realm as determined by *krb\_get\_lrealm*(3). The canonical form contains all of name, instance, and realm; the acl\_add and acl\_delete routines will always leave the file in that form.  Note that the canonical form of asp@ATHENA.MIT.EDU is actually asp.@ATHENA.MIT.EDU.

### Routines

*acl\_canonicalize\_principal* stores the canonical form of  *principal* in  *buf*. *Buf* must contain enough space to store a principal, given the limits on the sizes of name, instance, and realm specified as ANAME\_SZ, INST\_SZ, and REALM\_SZ, respectively, in */usr/include/krb.h*.

*acl\_check* returns nonzero if *principal* appears in  *acl*. Returns 0 if principal does not appear in acl, or if an error occurs.  Canonicalizes principal before checking, and allows the ACL to contain wildcards.  The only supported wildcards are entries of the form name.\*@realm, \*.\*@realm, and \*.\*@\*.  An asterisk matches any value for the its component field.  For example, "jtkohl.\*@\*" would match principal jtkohl, with any instance and any realm.

*acl\_exact\_match* performs like  *acl\_check*, but does no canonicalization or wildcard matching.

*acl\_add* atomically adds  *principal* to  *acl*. Returns 0 if successful, nonzero otherwise.  It is considered a failure if *principal* is already in  *acl*. This routine will canonicalize *principal*, but will treat wildcards literally.

*acl\_delete* atomically deletes  *principal* from  *acl*. Returns 0 if successful, nonzero otherwise.  It is considered a failure if  *principal* is not already in  *acl*. This routine will canonicalize  *principal*, but will treat wildcards literally.

*acl\_initialize* initializes *acl\_file*. If the file  *acl\_file* does not exist, *acl\_initialize* creates it with mode *mode*. If the file *acl\_file* exists, *acl\_initialize* removes all members.  Returns 0 if successful, nonzero otherwise.  WARNING: Mode argument is likely to change with the eventual introduction of an ACL service.

## NOTES

In the presence of concurrency, there is a very small chance that *acl\_add* or *acl\_delete* could report success even though it would have had no effect.  This is a necessary side effect of using lock files for concurrency control rather than [flock(2)](/flock/2.md), which is not supported by NFS.

The current implementation caches ACLs in memory in a hash-table format for increased efficiency in checking membership; one effect of the caching scheme is that one file descriptor will be kept open for each ACL cached, up to a maximum of 8.

## SEE ALSO

[kerberos(3)](/kerberos/3.md), krb\_get\_lrealm(3)

## AUTHOR

James Aspnes (MIT Project Athena)