.\"-
.\" Copyright (c) 2000 Robert N. M. Watson
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.\"       $FreeBSD$
.\"
.Dd January 28, 2000
.Dt ACL_VALID 3
.Os FreeBSD 4.0
.Sh NAME
.Nm acl_valid ,
.Nm acl_valid_fd_np ,
.Nm acl_valid_file_np
.Nd validate an ACL
.Sh LIBRARY
.Lb libposix1e
.Sh SYNOPSIS
.Fd #include <sys/types.h>
.Fd #include <sys/acl.h>
.Ft int
.Fn acl_valid "acl_t acl"
.Ft int
.Fn acl_valid_fd_np "int fd" "acl_type_t type" "acl_t acl"
.Ft int
.Fn acl_valid_file_np "const char *path_p" "acl_type_t type" "acl_t acl"
.Sh DESCRIPTION
These functions check that the ACL referred to by the argument
.Va acl
is valid.  The POSIX.1e routine,
.Fn acl_valid ,
checks this validity only with POSIX.1e ACL semantics, and irrespective
of the context in which the ACL is to be used.  The non-portable forms,
.Fn acl_valid_fd_np
and
.Fn acl_valid_file_np ,
allow an ACL to be checked in the context of a specific acl type,
.Va type ,
and file system object.  In environments where additional ACL types are
supported than just POSIX.1e, this makes more sense.

For POSIX.1e semantics, the checks include:
.Bd -literal -offset indent
The three required entries (ACL_USER_OBJ, ACL_GROUP_OBJ,
and ACL_OTHER) shall exist exactly once in the ACL.  If
the ACL contains any ACL_USER, ACL_GROUP, or any other
implementation-defined entries in the file group class
then one ACL_MASK entry shall also be required.  The ACL
shall contain at most on ACL_MASK entry.

The qualifier field shall be unique among all entries of
the same POSIX.1e ACL facility defined tag type.  The 
tag type field shall contain valid values including any
implementation-defined values.  Validation of the values
of the qualifier field is implementation-defined.
.Ed

The POSIX.1e
.Fn acl_valid
function may reorder the ACL for the purposes of verification; the
non-portable validation functions will not.  
.Sh IMPLEMENTATION NOTES
FreeBSD's support for POSIX.1e interfaces and features is still under
development at this time.
.Sh RETURN VALUES
Upon successful completion, the function shall return a value of zero.
Otherwise, a value of -1 shall be returned and
.Va errno
shall be set to indicate the error.
.Sh ERRORS
If any of the following conditions occur, these functions shall return
-1 and set
.Va errno
to the corresponding value:
.Bl -tag -width Er
.It Bq Er EACCES
Search permission is denied for a component of the path prefix, or the
object exists and the process does not have appropriate access rights.
.It Bq Er EBADF
The
.Va fd
argument is not a valid file descriptor.
.It Bq Er EINVAL
Argument
.Va acl
does not point to a valid ACL.

One or more of the required ACL entries is not present in
.Va acl .

The ACL contains entries that are not unique.

The file system rejects the ACL based on fs-specific semantics issues.
.It Bq Er ENAMETOOLONG
A component of a pathname exceeded 255 characters, or an
entire path name exceeded 1023 characters.
.It Bq Er ENOENT
The named object does not exist, or the
.Va path_p
argument points to an empty string.
.It Bq Er ENOMEM
Insufficient memory available to fulfill request.
.It Bq Er EOPNOTSUPP
The file system does not support ACL retrieval.
.El
.Sh SEE ALSO
.Xr acl 3 ,
.Xr acl_get 3 ,
.Xr acl_init 3 ,
.Xr acl_set 3 ,
.Xr posix1e 3
.Sh STANDARDS
POSIX.1e is described in IEEE POSIX.1e draft 17.  Discussion
of the draft continues on the cross-platform POSIX.1e implementation
mailing list.  To join this list, see the FreeBSD POSIX.1e implementation
page for more information.
.Sh HISTORY
POSIX.1e support was introduced in
.Fx 4.0 ,
and development continues.
.Sh AUTHORS
.An Robert N M Watson
.Sh BUGS
These features are not yet fully implemented.  In particular, the shipped
version of UFS/FFS does not support storage of additional security labels,
and so is unable to (easily) provide support for most of these features.