maildiracl — manage access control lists
maildiracl {-reset} {maildir}
maildiracl {-list} {maildir} {INBOX[.folder]}
maildiracl {-set} {maildir} {INBOX[.folder]} {[-]identifier} {[+/-]rights}
maildiracl {-delete} {maildir} {INBOX[.folder]} {[-]identifier}
maildiracl {-compute} {maildir} {INBOX[.folder]} {identifier...}
maildiracl manages “access control lists” (or ACLs) of the Courier IMAP server maildir folders. Access control lists are used primarily to provide fine-grained control for accessing virtual shared folders via IMAP.
The Courier IMAP server server implements two types of shared folders: filesystem permission-based shared folders, as well as virtual shared folders based on IMAP access control lists. Use the maildiracl command to set up access control lists for virtual shared folders. Use the maildirmake(1), command to implement shared folders based on filesystem permissions.
See the Courier IMAP server documentation for additional information on setting up virtual shared folders.
ACLs provide a fine-grained mechanism for controlling
access to shared folders.
ACLs may be used to specify, for example, that
user1 may only open and read the messages in the folder;
and user2 can not only do that, but also delete messages,
and create subfolders.
Each folder maintains its own individual access control list, that specifies
who can do what to the folder.
An ACL is a list of “identifier” and “rights”
pairs.
Each “identifier” and “rights” pair means that an
entity called “identifier”
(using the UTF-8 character set)
is allowed to do “rights”
on this folder.
“rights” consists of one or more letters, each letter
signifies a particular action:
identifier
may modify this folder's ACLs.
identifier
may create subfolders of this folder (this includes renaming another
folder as this folder's subfolders).
identifier
may remove deleted messages from this folder.
identifier
may add messages to this folder (either uploading them one by one,
or copying messages from another folder).
identifier
may actually see that this folder exists.
If identifier does not have the “l”
right on this folder, the folder is effectively invisible to
identifier.
identifier
may open this folder.
Note that if identifier
knows the name of this folder, it can open it even if
identifier does not the “l”
right on this folder.
identifier
may mark messages in this folder as seen, or unseen.
identifier
may mark messages in this folder as deleted, or undeleted.
identifier
may change other status flags of messages in this folder.
May also add or remove custom keywords on individual messages.
identifier
may delete this folder (which includes renaming this folder as another
mailbox's subfoler.
An ACL entry of “-identifier” and “rights” is called a “negative right”, which explicitly removes “rights” from “identifier”. More than one “identifier” is usually used to determine the actual rights someone has for the given folder. The actual access rights are determined by taking all rights from all applicable