mod_dav_acl

mod_dav_acl is a module implementation of Apache RFC3744 (Access Control Rights). In order to use this module, the Apache patches must be applied, mostly to the mod_dav module. The patch includes strong ETag handling, usec timestamps to ETags, conditional PUTs, and some hooks to allow integration to ACL handlings. Apply the patch to Apache sources and compile it before using this module. Additionally, a patch to the apr library is required to enable nano(actually usec)second timestamps in resources. The patch is included but optional (etags aren't just that strong without it).

ACL (meta)info is stored within the extended attributes of the filesystem, with XFS being the most convenient to work with (65k ea limit + nanosecond timestamps enabled by default). In ext3 filesystem, eas can be enabled with the option user_xattr.

Principals are stored into a shared memory segment to allow faster ACL processing. However, some other optimizations would be nice as well.

The configuration directives are as follows:
- AclLockFile: lock filename for shared memory
- AclSharedMemFile: shared memory name
- AclSharedMemSize: max size of shared memory segment, contains principal uris
- AclPrincipals: base URI for principals
- AclPrincipalDir: real absolute directory path for principals
- AclOwnerFullRights: the owner (if exists) has full rights to the resource if no acl is set
- DAVETagResponse: enable strong ETag responses (required by e.g. CalDAV/XCAP)
- DAVACL: enable ACL handling

For principal editings, a simple shell script called principals.sh is included for adding/removing principals (needs some changes before use) based on sending simple http (dav) requests by using libcurl to the server. It does not include adding user identities into the password database (htdigest e.g.), so users (+credentials) must be added separately.

To install, run ./configure && make && make install. You typically also need e.g. autoreconf -i to auto-generate ./configure script.

Once the module is successfully compiled and loaded, tests can be run with make check or by running ./acl_tests. A simple libcurl test client will send some basic tests to a server listening at localhost. You need to create (digest) users: joe, joppe and admin before running the tests (all share the same password == password) unless you modify the scripts, of course. Also, /xxx/principals and /xxx/acltests directories must be created and accessible by apache (in debian www-data user).

An example dav_acl.conf for testing purposes has been provided, including GLOBALS but can, of course, be local as well.

This release includes a _proper_ Apache 2.2.8 patch and some test & test configuration updates.