Subject: Update to ACL processing description

From: Spencer Shepler <[email-masked]>
Date: Tue, 02 Nov 1999 11:50:00 -0600

Based on input from Carl Beame, I have updated the I-D to include
this new description of processing an NFS ACE:

  "To determine if an ACCESS or OPEN request succeeds each nfsace4 entry
   is processed in order by the server.  Only ACEs which have a "who"
   that matches the requestor are considered.  Each ACE is processed
   until all of the bits of the requestor's access have been ALLOWED.
   Once a bit (see below) has been ALLOWED by an ACCESS_ALLOWED_ACE, it
   is no longer considered in the processing of later ACEs. If an
   ACCESS_DENIED_ACE is encountered where the requestor's mode still has
   unALLOWED bits in common with the "access_mask" of the ACE, the
   request is denied."

I have also updated the definitions of the generic read/write/execute
masks as follows:

/*
 * ACE4_GENERIC_READ -- defined as combination of
 *	ACE4_READ_ACL |
 *	ACE4_READ_DATA |
 *	ACE4_READ_ATTRIBUTES |
 *	ACE4_SYNCHRONIZE
 */

const ACE4_GENERIC_READ	= 0x00120081;

/*
 * ACE4_GENERIC_WRITE -- defined as combination of
 * 	ACE4_READ_ACL |
 *	ACE4_WRITE_DATA |
 *	ACE4_WRITE_ATTRIBUTES |
 *	ACE4_WRITE_ACL |
 *	ACE4_APPEND_DATA |
 *	ACE4_SYNCHRONIZE
 */
const ACE4_GENERIC_WRITE = 0x00160102;

/*
 * ACE4_GENERIC_EXECUTE -- defined as combination of
 *	ACE4_READ_ACL
 *	ACE4_READ_ATTRIBUTES
 *	ACE4_EXECUTE
 *	ACE4_SYNCHRONIZE
 */
const ACE4_GENERIC_EXECUTE = 0x001200A0;