POSIX.1e describes a set of extension to regular file permissions known as Access Control Lists, or ACLs. ACLs allow file owners to specify extended access information about a file, granting additional rights to users/groups other than those owning the file. This form of discretionary access control allows users to manage their own collaborative projects without intervention of system administrators to maintain groups, but also without granting rights to all users on the system via use of the "other" permission bits.
ACL and Extended Attribute interfaces were recently committed to 4.0-CURRENT in the central FreeBSD source repository. Supporting libraries and man pages will be commited in the next couple of days. In the mean time, an older implementation of some of the libraries and userland utilities is available for downloader here, although it should be noted that some interfaces have changed. When additional code has been commited, it will be announced on freebsd-security. The extended attribute code will make a number of other POSIX.1e facilities possible, including persistent storage of MAC labels and capabilities for executables.
A partial implementation of ACLs based on FreeBSD 4.0-CURRENT is now available. The code provides a basic kernel framework for ACLs (syscall interface, vnode interface, syntax and semantics checking routines, evaluation routines), support libraries (most of the POSIX.1e draft standard interface), and some userland programs to support ACLs. This work is not yet complete, as currently FFS does not have the ability to store ACLs on disk, and wrapper code has not yet been written to add support for the POSIX.1e interface to file systems that do support ACLs (Coda, NFS, AFS, etc). The command line interface for setting ACLs is not yet complete, and other utilities, such as ls and backup utilities, have not been modified to be aware of ACLs. As such, this implementation should be considered EXPERIMENTAL and not relied on in production machines.
This code is provided under a standard 2-clause BSD-style license to encourage interoperability and widespread use. Other licensing terms could be worked out if required, but a BSD-style license is generally sufficiently liberal that code under the license may be incorporated into most open-source and commercially licensed software. Please contact me for more information.
The code is provided in a tarball that includes kernel patches, new kernel files, a support library, userland utilities, and test code.
Email Robert Watson for more information, or to suggest changes to his page.
Back to the FreeBSD POSIX.1e Page
Back to the FreeBSD Hardening Project