sec_acl_test_access_on_behalf(3sec)
Tests access to an object on behalf of another process
Synopsis
#include <dce/daclif.h>
boolean32 sec_acl_test_access_on_behalf(
sec_acl_handle_t h,
uuid_t
*manager_type,
sec_id_pac_t *subject,
sec_acl_permset_t desired_permset,
error_status_t
*status);
Parameters
Input
h
A handle referring to the target object. Use sec_acl_bind( ) to create this handle.
manager_type
A pointer to the UUID identifying the type of the ACL manager in question. There may be more than one type of ACL manager protecting the object whose ACL is bound
to the input handle. Use this parameter to distinguish them. Use sec_acl_get_manager_types( ) to acquire a list of the manager types protecting a given object.
subject
A Privilege Attribute Certificate (PAC) for the subject process. The PAC contains the name and UUID of the principal and cell of the subject process, as well as a list
of any groups to which it belongs. The PAC also contains a flag (named authenticated). When set, it indicates that the certificate was obtained from an authenticated source. When not set,
the certificate must not be trusted. (The field is FALSE when it was obtained from the rpc_auth(3rpc) layer and the protect level was set to rpc_c_protect_level_none.
This indicates that no authentication protocol was actually used in the remote procedure call; the identity was simply transmitted from the caller to the callee. If an authentication protocol was
used, then the flag is set to TRUE.)
If a null PAC is passed, the subject is treated as an anonymous user, matching only the any_other and unauthenticated entries (if they exist) on the ACL.
A server uses rpc_binding_inq_auth_client( ) to acquire a certificate for the client process.
desired_permset
A permission set in sec_acl_permset_t form containing the desired privileges. This is a 32-bit set of permission flags supported by the manager type.
Output
status
A pointer to the completion status. On successful completion, the routine returns error_status_ok. Otherwise, it returns an error.
Description
The sec_acl_test_access_on_behalf( ) routine determines if the specified ACL contains entries that grant the privileges specified in
desired_permset to the subject process. An application generally inquires about only the minimum set of privileges needed to accomplish a specific task.
Permissions Required
The sec_acl_test_access_on_behalf( ) routine requires at least one permission of any kind on the object for which the privileges are to be tested.
Both the calling process and the identified subject must have permission on the object.
Files
/usr/include/dce/daclif.idl
The idl file from which dce/daclif.h was derived.
Return Values
If the routine completes successfully (with a completion status of error_status_ok) it returns a value of
· TRUE if the caller has any access (at least one permission of any kind), and the subject has the desired_permset privileges.
· FALSE if both the caller and the subject have any access, but the subject does not have the desired_permset privileges.
If the routine does not complete successfully, it returns a bad completion status code and a return value of FALSE.
Errors
The following describes a partial list of errors that might be returned. Refer to the OSF DCE Problem Determination Guide for complete descriptions of all error messages.
sec_acl_unknown_manager_type
The manager type selected is not an available option.
error_status_ok
The call was successful.
sec_acl_not_implemented
Requested operation is not implemented in this version of DCE.
Related Information
Functions:
rpc_binding_inq_auth_client(3rpc)