Download PDF file

Appendix B: User-Group ACLs
49
Appendix B User-Group ACLs
This appendix describes the ‘user-group’ extension for GNU Pies ACLs.
This extension is reserved for the future use.
The user-group ACL statement specifies which users match this entry.
Allowed values are the following:
all
All users.
authenticated
Only authenticated users.
group group-list
Authenticated users which are members of at least one of groups
listed in group-list.
For example, the following statement defines an ACL which allows access
for any user connected via local UNIX socket ‘/tmp/pies.sock’ or coming
from a local network ‘192.168.10.0/24’. Any authenticated users are allowed, provided that they are allowed by another ACL ‘my-nets’ (which
should have been defined before this definition). Users coming from the network ‘10.10.0.0/24’ are allowed if they authenticate themselves and are
members of groups ‘pies’ or ‘users’. Access is denied for anybody else:
acl {
allow all from ("/tmp/pies.sock", "192.168.10.0/24");
allow authenticated acl "my-nets";
allow group ("pies", "users") from "10.10.0.0/24";
deny all;
}