Advanced ACL topics
Some high-level topics that we skimmed over during the configuration of our ACL environment had to do with ACE permissions and the use of the GrantedAuthority indicators to assist the ACL environment in determining whether certain types of runtime changes to ACLs were allowed. Now that we have a working environment, we’ll review these more advanced topics.
How permissions work
Permissions are no more than single logical identifiers represented by bits in an integer. An ACE grants permissions to SIDs based on the bitmask, which comprises the logical and of all permissions applicable to that ACE.
The default permission implementation, o.s.s.acls.domain.BasePermission, defines a series of integer values representing common ACL authorization verbs. These integer values correspond to single bits set in an integer, so a value of BasePermission, WRITE, with an integer value of 1 has a bitwise value of 21 or 2.
These are illustrated in the following diagram...
