$FreeBSD$

  UFS Access Control Lists Copyright

The UFS Access Control Lists implementation is copyright Robert Watson,
and is made available under a Berkeley-style license.

  About UFS Access Control Lists (ACLs)

Access control lists allow the association of fine-grained discretionary
access control information with files and directories, extending the
base UNIX permission model in a (mostly) compatible way.  This
implementation largely follows the POSIX.1e model, and relies on the
availability of extended attributes to store extended components of
the ACL, while maintaining the base permission information in the inode.

  Using UFS Access Control Lists (ACLs)

Support for UFS access control lists may be enabled by adding:

	options UFS_ACL

to your kernel configuration.  As ACLs rely on the availability of extended
attributes, you must also enable support for extended attributes on the
underlying filesystem.  Currently, this requires the use of UFS EAs, which
may be enabled by adding:

	options UFS_EXTATTR

to your kernel.  Because of filesystem mount atomicity requirements,
it is also recommended that:

	options UFS_EXTATTR_AUTOSTART

be added to the kernel so as to support the atomic enabling of the
required extended attributes with the filesystem mount operation.  To
enable ACLs, two extended attributes must be available in the
EXTATTR_NAMESPACE_SYSTEM namespace: "posix1e.acl_access", which holds
the access ACL, and "posix1e.acl_default" which holds the default ACL
for directories.  If you're using UFS Extended Attributes, the following
commands may be used to create the necessary EA backing files for
ACLs in the filesystem root of each filesystem.  In these examples,
the root filesystem is used; see README.extattr for more details.

  mkdir -p /.attribute/system
  cd /.attribute/system
  extattrctl initattr -p / 388 posix1e.acl_access
  extattrctl initattr -p / 388 posix1e.acl_default

On the next mount of the root filesystem, the attributes will be
automatically started, and ACLs will be enabled.