1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
|
<!DOCTYPE html>
<html class="writer-html5" lang="en" >
<head>
<meta charset="utf-8" /><meta name="generator" content="Docutils 0.19: https://docutils.sourceforge.io/" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Access Control Lists Rights Reference — Cyrus IMAP 3.10.2 documentation</title>
<link rel="stylesheet" href="../../../../_static/pygments.css" type="text/css" />
<link rel="stylesheet" href="../../../../_static/css/theme.css" type="text/css" />
<link rel="stylesheet" href="../../../../_static/graphviz.css" type="text/css" />
<link rel="stylesheet" href="../../../../_static/cyrus.css" type="text/css" />
<script data-url_root="../../../../" id="documentation_options" src="../../../../_static/documentation_options.js"></script>
<script src="../../../../_static/jquery.js"></script>
<script src="../../../../_static/underscore.js"></script>
<script src="../../../../_static/_sphinx_javascript_frameworks_compat.js"></script>
<script src="../../../../_static/doctools.js"></script>
<script src="../../../../_static/sphinx_highlight.js"></script>
<script src="../../../../_static/js/theme.js"></script>
<link rel="index" title="Index" href="../../../../genindex.html" />
<link rel="search" title="Search" href="../../../../search.html" />
<link rel="next" title="Quotas" href="../quotas.html" />
<link rel="prev" title="Access Control Identifier (ACI)" href="identifiers.html" />
</head>
<body class="wy-body-for-nav">
<div class="wy-grid-for-nav">
<nav data-toggle="wy-nav-shift" class="wy-nav-side">
<div class="wy-side-scroll">
<div class="wy-side-nav-search" >
<a href="../../../../index.html" class="icon icon-home">
Cyrus IMAP
</a>
<div class="version">
3.10.2
</div>
<div role="search">
<form id="rtd-search-form" class="wy-form" action="../../../../search.html" method="get">
<input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
</div>
</div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
<p class="caption" role="heading"><span class="caption-text">Cyrus IMAP</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../../../../download.html">Download</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../quickstart.html">Quickstart Guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../overview.html">Overview</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../setup.html">Setup</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="../../../../operations.html">Operations</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="../../manpages/index.html">Man pages</a></li>
<li class="toctree-l2 current"><a class="reference internal" href="../../admin.html">Administrator Guide</a><ul class="current">
<li class="toctree-l3"><a class="reference internal" href="../../admin.html#architecture">Architecture</a></li>
<li class="toctree-l3 current"><a class="reference internal" href="../../admin.html#management">Management</a><ul class="current">
<li class="toctree-l4"><a class="reference internal" href="../locations.html">File & Directory Locations</a></li>
<li class="toctree-l4"><a class="reference internal" href="../ports-sockets.html">Ports and Sockets</a></li>
<li class="toctree-l4 current"><a class="reference internal" href="../access-control.html">Access Control</a></li>
<li class="toctree-l4"><a class="reference internal" href="../quotas.html">Quotas</a></li>
<li class="toctree-l4"><a class="reference internal" href="../sieve.html">Cyrus Sieve</a></li>
<li class="toctree-l4"><a class="reference internal" href="../backups.html">Cyrus Backups</a></li>
<li class="toctree-l4"><a class="reference internal" href="../nntp.html">Cyrus NNTP</a></li>
<li class="toctree-l4"><a class="reference internal" href="../protlayer.html">Cyrus Prot Layer</a></li>
<li class="toctree-l4"><a class="reference internal" href="../sop.html">Standard Operating Procedures</a></li>
<li class="toctree-l4"><a class="reference internal" href="../eventsource.html">Cyrus Event Source</a></li>
<li class="toctree-l4"><a class="reference internal" href="../monitoring.html">Monitoring</a></li>
<li class="toctree-l4"><a class="reference internal" href="../config-mailboxdistribution.html">Mailbox Distribution</a></li>
<li class="toctree-l4"><a class="reference internal" href="../murder/murder.html">Cyrus Murder</a></li>
<li class="toctree-l4"><a class="reference internal" href="../nginx-proxy.html">HOWTO: Using an NGINX IMAP Proxy</a></li>
<li class="toctree-l4"><a class="reference internal" href="../tweaking.html">Tweaking Cyrus IMAP</a></li>
</ul>
</li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../../faq.html">Frequently Asked Questions</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../../../../developers.html">Developers</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../../../support.html">Support/Community</a></li>
</ul>
<p class="caption" role="heading"><span class="caption-text">Cyrus SASL</span></p>
<ul>
<li class="toctree-l1"><a class="reference external" href="http://www.cyrusimap.org/sasl">Cyrus SASL</a></li>
</ul>
</div>
</div>
</nav>
<section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
<i data-toggle="wy-nav-top" class="fa fa-bars"></i>
<a href="../../../../index.html">Cyrus IMAP</a>
</nav>
<div class="wy-nav-content">
<div class="rst-content">
<div role="navigation" aria-label="Page navigation">
<ul class="wy-breadcrumbs">
<li><a href="../../../../index.html" class="icon icon-home" aria-label="Home"></a></li>
<li class="breadcrumb-item"><a href="../../../../operations.html">Operations</a></li>
<li class="breadcrumb-item"><a href="../../admin.html">Administrator Guide</a></li>
<li class="breadcrumb-item"><a href="../access-control.html">Access Control</a></li>
<li class="breadcrumb-item active">Access Control Lists Rights Reference</li>
<li class="wy-breadcrumbs-aside">
<a href="https://github.com/cyrusimap/cyrus-imapd/blob/master/docsrc/imap/reference/admin/access-control/rights-reference.rst" class="fa fa-github"> Edit on GitHub</a>
</li>
</ul>
<hr/>
</div>
<div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
<div itemprop="articleBody">
<section id="access-control-lists-rights-reference">
<span id="imap-admin-access-control-lists-rights-reference"></span><h1>Access Control Lists Rights Reference<a class="headerlink" href="#access-control-lists-rights-reference" title="Permalink to this heading"></a></h1>
<p>Access rights in Cyrus IMAP are fully compatible with <span class="target" id="index-0"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc4314.html"><strong>RFC 4314</strong></a>,
<em>IMAP4 Access Control List (ACL) Extension</em>, which has obsoleted
<span class="target" id="index-1"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc2086.html"><strong>RFC 2086</strong></a>.</p>
<p>Additional documentation on Access Control is available in the following
documents:</p>
<ul class="simple">
<li><p><a class="reference internal" href="combining-rights.html#imap-admin-access-control-combining-rights"><span class="std std-ref">Combining Access Rights</span></a></p></li>
<li><p><a class="reference internal" href="defaults.html#imap-admin-access-control-defaults"><span class="std std-ref">Access Control Defaults</span></a></p></li>
</ul>
<section id="individual-rights-reference">
<h2>Individual Rights Reference<a class="headerlink" href="#individual-rights-reference" title="Permalink to this heading"></a></h2>
<section id="l">
<span id="imap-admin-access-control-right-l"></span><h3><code class="docutils literal notranslate"><span class="pre">l</span></code><a class="headerlink" href="#l" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>Stands for <strong>lookup</strong>.</p>
<p>The ACI subject can lookup this folder, and see that the folder
exists, meaning the folder will appear in the response to a
<code class="docutils literal notranslate"><span class="pre">LIST</span> <span class="pre">""</span> <span class="pre">"*"</span></code> command issued by a client.</p>
<p>Folders to which the ACI subject has no lookup rights may still be
subscribed to. The lookup right is only required if Cyrus IMAP has
been configured with the <code class="docutils literal notranslate"><span class="pre">allowallsubscribe</span></code> setting to <code class="docutils literal notranslate"><span class="pre">0</span></code>.</p>
<p>This setting defaults to <code class="docutils literal notranslate"><span class="pre">0</span></code>. In a Cyrus IMAP Murder, this setting
is typically set to <code class="docutils literal notranslate"><span class="pre">1</span></code>.</p>
<p>The <a class="reference internal" href="#imap-admin-access-control-right-l"><span class="std std-ref">l</span></a> right can be assigned
to a folder, without the <a class="reference internal" href="#imap-admin-access-control-right-l"><span class="std std-ref">l</span></a>
right having been given out for the parent folder. Cyrus IMAP will
pretend the parent folder does not exist;</p>
<p><span class="target" id="index-2"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc4314.html"><strong>RFC 4314</strong></a>, states the following example in section 4:</p>
<blockquote class="epigraph">
<div><p>Note that if the user has
<a class="reference internal" href="#imap-admin-access-control-right-l"><span class="std std-ref">l</span></a> right to a mailbox
<code class="docutils literal notranslate"><span class="pre">A/B</span></code>, but not to its parent mailbox <code class="docutils literal notranslate"><span class="pre">A</span></code>, the <code class="docutils literal notranslate"><span class="pre">LIST</span></code>
command should behave as if the mailbox <code class="docutils literal notranslate"><span class="pre">A</span></code> doesn't exist, for
example:</p>
<pre class="literal-block">C: A777 LIST "" *
S: * LIST (\NoInferiors) "/" "A/B"
S: * LIST () "/" "C"
S: * LIST (\NoInferiors) "/" "C/D"
S: A777 OK LIST completed</pre>
</div></blockquote>
</div></blockquote>
</section>
<section id="r">
<span id="imap-admin-access-control-right-r"></span><h3><code class="docutils literal notranslate"><span class="pre">r</span></code><a class="headerlink" href="#r" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>Stands for <strong>read</strong>.</p>
<p>The ACI subject can read the contents of this folder, meaning that
the ACI subject is allowed to <code class="docutils literal notranslate"><span class="pre">SELECT</span></code> or <code class="docutils literal notranslate"><span class="pre">EXAMINE</span></code> the folder,
query its <code class="docutils literal notranslate"><span class="pre">STATUS</span></code>, <code class="docutils literal notranslate"><span class="pre">FETCH</span></code> data, <code class="docutils literal notranslate"><span class="pre">SEARCH</span></code> the contents, and
<code class="docutils literal notranslate"><span class="pre">COPY</span></code> contents from the folder.</p>
<p>The <a class="reference internal" href="#imap-admin-access-control-right-r"><span class="std std-ref">r</span></a> right also allows the
user to <code class="docutils literal notranslate"><span class="pre">GETMETADATA</span></code> when used in conjunction with the
<a class="reference internal" href="#imap-admin-access-control-right-l"><span class="std std-ref">l</span></a> right, as defined in
<span class="target" id="index-3"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc5464.html"><strong>RFC 5464</strong></a>.</p>
</div></blockquote>
</section>
<section id="s">
<span id="imap-admin-access-control-right-s"></span><h3><code class="docutils literal notranslate"><span class="pre">s</span></code><a class="headerlink" href="#s" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>Stands for <strong>seen</strong>.</p>
<p>The ACI subject is permitted to maintain the ACI subject's seen
state for this folder, or the shared seen state in case the
<code class="docutils literal notranslate"><span class="pre">/vendor/cmu/cyrus-imapd/sharedseen</span></code> has been set to <code class="docutils literal notranslate"><span class="pre">1</span></code> (see
<a class="reference internal" href="../../manpages/systemcommands/cyradm.html#imap-reference-manpages-systemcommands-cyradm"><span class="std std-ref">NAME</span></a>).</p>
<p>Additionally, the <code class="docutils literal notranslate"><span class="pre">\Recent</span></code> flags are preserved for the ACI
subject.</p>
</div></blockquote>
</section>
<section id="w">
<span id="imap-admin-access-control-right-w"></span><h3><code class="docutils literal notranslate"><span class="pre">w</span></code><a class="headerlink" href="#w" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>Stands for <strong>write</strong>.</p>
<p>The ACI subject is permitted to write to the folder, actually
meaning the ACI subject is permitted to maintain flags and keywords
other then <code class="docutils literal notranslate"><span class="pre">\Seen</span></code> and <code class="docutils literal notranslate"><span class="pre">\Deleted</span></code>, which are controlled using
the <a class="reference internal" href="#imap-admin-access-control-right-s"><span class="std std-ref">s</span></a> and
<a class="reference internal" href="#imap-admin-access-control-right-t"><span class="std std-ref">t</span></a> rights respectively.</p>
<p>The <a class="reference internal" href="#imap-admin-access-control-right-w"><span class="std std-ref">w</span></a> right also allows the
user to <code class="docutils literal notranslate"><span class="pre">SETMETADATA</span></code> when used in conjunction with the
<a class="reference internal" href="#imap-admin-access-control-right-l"><span class="std std-ref">l</span></a> and
<a class="reference internal" href="#imap-admin-access-control-right-r"><span class="std std-ref">r</span></a> rights, as defined in
<span class="target" id="index-4"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc5464.html"><strong>RFC 5464</strong></a>.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>IMAP clients may expect to be able to set flags other than
<code class="docutils literal notranslate"><span class="pre">\Seen</span></code> and <code class="docutils literal notranslate"><span class="pre">\Deleted</span></code> and attempt to set those flags
immediately along with a "Mark as read" action, but without the
ACI subject actually being permitted to set some of those flags
through the <a class="reference internal" href="#imap-admin-access-control-right-w"><span class="std std-ref">w</span></a> right.</p>
<p><span class="target" id="index-5"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc4314.html"><strong>RFC 4314</strong></a>, section 4., page 15, states that the server SHOULD
NOT fail, as the tagged NO response is not handled very well by
deployed clients.</p>
<p>In order to comply, we have <a class="reference external" href="https://github.com/cyrusimap/cyrus-imapd/issues/1375">Bug #1375</a>, as
Cyrus IMAP currently does seem to issue a tagged <code class="docutils literal notranslate"><span class="pre">NO</span></code>
response.</p>
</div>
</div></blockquote>
</section>
<section id="i">
<span id="imap-admin-access-control-right-i"></span><h3><code class="docutils literal notranslate"><span class="pre">i</span></code><a class="headerlink" href="#i" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>Stands for <strong>insert</strong>.</p>
<p>The ACI subject is permitted to insert content into a folder,
meaning the ACI subject may <code class="docutils literal notranslate"><span class="pre">COPY</span></code> messages with this folder as
the target folder, and may <code class="docutils literal notranslate"><span class="pre">APPEND</span></code> messages to this folder.</p>
</div></blockquote>
</section>
<section id="p">
<span id="imap-admin-access-control-right-p"></span><h3><code class="docutils literal notranslate"><span class="pre">p</span></code><a class="headerlink" href="#p" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>Stands for <strong>post</strong>.</p>
<p>The post right currently is exclusive to Cyrus IMAP, and allows the
ACI subject to send email to the submission address for the mailbox.</p>
<p>This right differs from the <a class="reference internal" href="#imap-admin-access-control-right-i"><span class="std std-ref">i</span></a>
right in that the delivery system inserts trace information into
submitted messages.</p>
<p>Example implementations using the
<a class="reference internal" href="#imap-admin-access-control-right-p"><span class="std std-ref">p</span></a> right include shared
folders to which specific recipient addresses are delivered through
LMTP pre-authorized as the <code class="docutils literal notranslate"><span class="pre">postuser</span></code>, which must then also have
the <a class="reference internal" href="#imap-admin-access-control-right-p"><span class="std std-ref">p</span></a> right on the target
folder.</p>
</div></blockquote>
</section>
<section id="c">
<span id="imap-admin-access-control-right-c"></span><h3><code class="docutils literal notranslate"><span class="pre">c</span></code><a class="headerlink" href="#c" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>Stands for <strong>create</strong>.</p>
<p>The create right is a right introduced with <span class="target" id="index-6"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc2086.html"><strong>RFC 2086</strong></a>, indicating
the ACI subject's right to create new sub-folders in the parent
folder on which this right has been assigned, but also to delete the
same folder.</p>
<p>Since <span class="target" id="index-7"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc4314.html"><strong>RFC 4314</strong></a>, the <a class="reference internal" href="#imap-admin-access-control-right-c"><span class="std std-ref">c</span></a>
right has been replaced with the
<a class="reference internal" href="#imap-admin-access-control-right-k"><span class="std std-ref">k</span></a> right to allow the ACI
subject to <code class="docutils literal notranslate"><span class="pre">CREATE</span></code> folders, and the
<a class="reference internal" href="#imap-admin-access-control-right-x"><span class="std std-ref">x</span></a> right to allow the ACI
subject to <code class="docutils literal notranslate"><span class="pre">DELETE</span></code> folders.</p>
<div class="admonition important">
<p class="admonition-title">Important</p>
<p>The <a class="reference internal" href="#imap-admin-access-control-right-c"><span class="std std-ref">c</span></a> right should no
longer be used. It will be deprecated completely in version
3.0.</p>
<p>While Cyrus IMAP is backwards compatible when it comes to the
<a class="reference internal" href="#imap-admin-access-control-right-c"><span class="std std-ref">c</span></a> right, which it
implements as implying as the
<a class="reference internal" href="#imap-admin-access-control-right-k"><span class="std std-ref">k</span></a> right, implementations
should not count on the <a class="reference internal" href="#imap-admin-access-control-right-c"><span class="std std-ref">c</span></a>
right backwards compatibility to be around forever, and fully
implement the successor rights
<a class="reference internal" href="#imap-admin-access-control-right-k"><span class="std std-ref">k</span></a> and
<a class="reference internal" href="#imap-admin-access-control-right-x"><span class="std std-ref">x</span></a>.</p>
</div>
</div></blockquote>
</section>
<section id="k">
<span id="imap-admin-access-control-right-k"></span><h3><code class="docutils literal notranslate"><span class="pre">k</span></code><a class="headerlink" href="#k" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>The ACI subject has the right to <code class="docutils literal notranslate"><span class="pre">CREATE</span></code> a new folder if the
<a class="reference internal" href="#imap-admin-access-control-right-k"><span class="std std-ref">k</span></a> right exists on the parent
folder of the folder to be created.</p>
<p>The rights required for a <code class="docutils literal notranslate"><span class="pre">RENAME</span></code> to be successful could be
illustrated by describing a <code class="docutils literal notranslate"><span class="pre">RENAME</span></code> as a <code class="docutils literal notranslate"><span class="pre">CREATE</span></code> of the new
folder, not exactly followed by a <code class="docutils literal notranslate"><span class="pre">COPY</span></code> on the old folder's
contents, but more like a move like on a filesystem, and finally a
<code class="docutils literal notranslate"><span class="pre">DELETE</span></code> on the old folder.</p>
<p>As such, the <a class="reference internal" href="#imap-admin-access-control-right-k"><span class="std std-ref">k</span></a> is the right
required on the parent folder of the target folder, and the
<a class="reference internal" href="#imap-admin-access-control-right-x"><span class="std std-ref">x</span></a> right on the source folder.</p>
<p>To further illustrate, suppose the ACI subject has the
<a class="reference internal" href="#imap-admin-access-control-right-k"><span class="std std-ref">k</span></a> right on folder
<code class="docutils literal notranslate"><span class="pre">C/</span></code>, and the <a class="reference internal" href="#imap-admin-access-control-right-x"><span class="std std-ref">x</span></a> right on
folder <code class="docutils literal notranslate"><span class="pre">A/B</span></code>. The execution of the command <code class="docutils literal notranslate"><span class="pre">RENAME</span> <span class="pre">A/B</span> <span class="pre">C/B</span></code>
would succeed.</p>
</div></blockquote>
</section>
<section id="a">
<span id="imap-admin-access-control-right-a"></span><h3><code class="docutils literal notranslate"><span class="pre">a</span></code><a class="headerlink" href="#a" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>Stands for <strong>administer</strong>.</p>
<p>The ACI subject is allowed to administer the folder, meaning the ACI
subject is allowed to perform administrative operations on the
folder.</p>
<p>The <a class="reference internal" href="#imap-admin-access-control-right-a"><span class="std std-ref">a</span></a> right is needed to
successfully execute <code class="docutils literal notranslate"><span class="pre">SETACL</span></code>, <code class="docutils literal notranslate"><span class="pre">DELETEACL</span></code> (short for
<code class="docutils literal notranslate"><span class="pre">SETACL</span> <span class="pre">""</span></code>) and to execute <code class="docutils literal notranslate"><span class="pre">GETACL</span></code> or <code class="docutils literal notranslate"><span class="pre">LISTRIGHTS</span></code>.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>IMAP clients may issue a <code class="docutils literal notranslate"><span class="pre">GETACL</span></code> in order to obtain the ACI
subject's rights on the folder, where they should be using
<code class="docutils literal notranslate"><span class="pre">MYRIGHTS</span></code>, as <code class="docutils literal notranslate"><span class="pre">GETACL</span></code> or <code class="docutils literal notranslate"><span class="pre">LISTRIGHTS</span></code> return the full
Access Control List, including other ACI subject's identifiers.</p>
<p>However unless the ACI subject has the
<a class="reference internal" href="#imap-admin-access-control-right-a"><span class="std std-ref">a</span></a> right on a folder,
issuing a <code class="docutils literal notranslate"><span class="pre">GETACL</span></code> or <code class="docutils literal notranslate"><span class="pre">LISTRIGHTS</span></code> will cause Cyrus IMAP to
send a tagged <code class="docutils literal notranslate"><span class="pre">NO:</span> <span class="pre">Permission</span> <span class="pre">denied</span></code> response if the ACI
subject has the <a class="reference internal" href="#imap-admin-access-control-right-l"><span class="std std-ref">l</span></a> right
on the folder, and a <code class="docutils literal notranslate"><span class="pre">NO:</span> <span class="pre">No</span> <span class="pre">Such</span> <span class="pre">Mailbox</span></code> response otherwise,
as per section 8 of <span class="target" id="index-8"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc2086.html"><strong>RFC 2086</strong></a> and section 6 of <span class="target" id="index-9"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc4314.html"><strong>RFC 4314</strong></a> --
both conveniently called <em>Security Considerations</em> -- which
state that the IMAP server must not inadvertently admit the
mailbox exists.</p>
</div>
</div></blockquote>
</section>
<section id="x">
<span id="imap-admin-access-control-right-x"></span><h3><code class="docutils literal notranslate"><span class="pre">x</span></code><a class="headerlink" href="#x" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>Use the <a class="reference internal" href="#imap-admin-access-control-right-x"><span class="std std-ref">x</span></a> right to indicate
the ACI subject has the right to <code class="docutils literal notranslate"><span class="pre">DELETE</span></code> the folder on which the
ACL is set, as opposed to the now obsolete
<a class="reference internal" href="#imap-admin-access-control-right-c"><span class="std std-ref">c</span></a> right or
<a class="reference internal" href="#imap-admin-access-control-right-d"><span class="std std-ref">d</span></a> right.</p>
</div></blockquote>
</section>
<section id="t">
<span id="imap-admin-access-control-right-t"></span><h3><code class="docutils literal notranslate"><span class="pre">t</span></code><a class="headerlink" href="#t" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>The ACI subject is allowed to delete messages from this folder,
meaning that the ACI subject is allowed to flag messages as
<code class="docutils literal notranslate"><span class="pre">\Deleted</span></code>.</p>
<p>In IMAP, messages are only actually deleted (i.e. in a way that
makes them invisible to users of the folder) after the folder's
contents have been expunged.</p>
<p>For the corresponding <code class="docutils literal notranslate"><span class="pre">EXPUNGE</span></code> command however, the
<a class="reference internal" href="#imap-admin-access-control-right-e"><span class="std std-ref">e</span></a> right is required.</p>
</div></blockquote>
</section>
<section id="n">
<span id="imap-admin-access-control-right-n"></span><h3><code class="docutils literal notranslate"><span class="pre">n</span></code><a class="headerlink" href="#n" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>The ACI subject is allowed to annotate individual messages in this
folder, in compliance with <span class="target" id="index-10"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc5257.html"><strong>RFC 5257</strong></a>.</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The ACI subject must also have at least the
<a class="reference internal" href="#imap-admin-access-control-right-r"><span class="std std-ref">r</span></a> right, as otherwise the
ACI subject won't know which messages are available to annotate.</p>
<p>This is not explicitly mentioned in the <span class="target" id="index-11"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc5257.html"><strong>RFC 5257</strong></a>, but
implied.</p>
</div>
</div></blockquote>
</section>
<section id="e">
<span id="imap-admin-access-control-right-e"></span><h3><code class="docutils literal notranslate"><span class="pre">e</span></code><a class="headerlink" href="#e" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>Stands for <strong>expunge</strong>.</p>
<p>The ACI subject is allowed to expunge messages in this folder,
meaning the ACI subject has the right to remove all messages that
have been flagged as <code class="docutils literal notranslate"><span class="pre">\Deleted</span></code> from all visibility.</p>
<p>In IMAP, expunging messages only applies to messages flagged as
<code class="docutils literal notranslate"><span class="pre">\Deleted</span></code>. For the ACI subject to be able to flag messages as
<code class="docutils literal notranslate"><span class="pre">\Deleted</span></code> however, the <a class="reference internal" href="#imap-admin-access-control-right-t"><span class="std std-ref">t</span></a>
right is required.</p>
<p>We say "remove from all visibility", because the implementation of
expunging messages in Cyrus IMAP is subject to the <code class="docutils literal notranslate"><span class="pre">expunge_mode</span></code>
setting in <a class="reference internal" href="../../manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a>, which when set to <code class="docutils literal notranslate"><span class="pre">delayed</span></code>
only causes the reference to the expunged messages to be deleted
from the folder index database -- effectively removing the expunged
message(s) from all visibility, while the individual message files
remain in place on the Cyrus IMAP server filesystem.</p>
<div class="admonition seealso">
<p class="admonition-title">See also</p>
<ul class="simple">
<li><p><a class="reference internal" href="../sop/deleting.html#imap-admin-sop-restoring-expunged-messages"><span class="std std-ref">Deleting and Undeleting Messages and Folders</span></a></p></li>
</ul>
</div>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>IMAP clients may expect to be able to <code class="docutils literal notranslate"><span class="pre">EXPUNGE</span></code> a folder
regardless of the availability of the
<a class="reference internal" href="#imap-admin-access-control-right-e"><span class="std std-ref">e</span></a> right to the current
user.</p>
</div>
</div></blockquote>
</section>
<section id="d">
<span id="imap-admin-access-control-right-d"></span><h3><code class="docutils literal notranslate"><span class="pre">d</span></code><a class="headerlink" href="#d" title="Permalink to this heading"></a></h3>
<blockquote>
<div><p>Stands for <strong>delete</strong>.</p>
<p>This is the legacy <span class="target" id="index-12"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc2086.html"><strong>RFC 2086</strong></a> access control right for the
<code class="docutils literal notranslate"><span class="pre">DELETE</span></code> command.</p>
<p>In versions of Cyrus IMAP implementing only this right (prior to
2.3.7), ACI subjects were allowed to flag messages as
<code class="docutils literal notranslate"><span class="pre">\Deleted</span></code>, and <code class="docutils literal notranslate"><span class="pre">EXPUNGE</span></code> and <code class="docutils literal notranslate"><span class="pre">DELETE</span></code> folders.</p>
<p>The delete right has been split in to three separate rights,
<a class="reference internal" href="#imap-admin-access-control-right-t"><span class="std std-ref">t</span></a> (flag messages as
<code class="docutils literal notranslate"><span class="pre">\Deleted</span></code>), <a class="reference internal" href="#imap-admin-access-control-right-e"><span class="std std-ref">e</span></a>
(<code class="docutils literal notranslate"><span class="pre">EXPUNGE</span></code> folder) and <a class="reference internal" href="#imap-admin-access-control-right-x"><span class="std std-ref">x</span></a>
(<code class="docutils literal notranslate"><span class="pre">DELETE</span></code> folder).</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The <code class="docutils literal notranslate"><span class="pre">deleteright</span></code> setting in <a class="reference internal" href="../../manpages/configs/imapd.conf.html#std-cyrusman-imapd.conf-5">imapd.conf(5)</a>
controls the <span class="target" id="index-13"></span><a class="rfc reference external" href="https://datatracker.ietf.org/doc/html/rfc2086.html"><strong>RFC 2086</strong></a> right which controls whether or not the
ACI subject may delete a folder. However, this setting (as the
original specification for the delete right was considered
ambiguous) is ignored, and if it is set to
<a class="reference internal" href="#imap-admin-access-control-right-c"><span class="std std-ref">c</span></a>, is automatically
converted to the <a class="reference internal" href="#imap-admin-access-control-right-x"><span class="std std-ref">x</span></a> right.</p>
</div>
<div class="admonition important">
<p class="admonition-title">Important</p>
<p>Even though Cyrus IMAP is backwards compatible when it comes to
the <a class="reference internal" href="#imap-admin-access-control-right-d"><span class="std std-ref">d</span></a> right, which it
implements as implying as the
<a class="reference internal" href="#imap-admin-access-control-right-e"><span class="std std-ref">e</span></a> and
<a class="reference internal" href="#imap-admin-access-control-right-t"><span class="std std-ref">t</span></a> rights, implementations
should not count on the <a class="reference internal" href="#imap-admin-access-control-right-d"><span class="std std-ref">d</span></a>
right backwards compatibility to be around forever, and instead
fully implement the successor rights
<a class="reference internal" href="#imap-admin-access-control-right-e"><span class="std std-ref">e</span></a>,
<a class="reference internal" href="#imap-admin-access-control-right-t"><span class="std std-ref">t</span></a> and
<a class="reference internal" href="#imap-admin-access-control-right-x"><span class="std std-ref">x</span></a> rights.</p>
</div>
</div></blockquote>
</section>
</section>
</section>
</div>
</div>
<footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
<a href="identifiers.html" class="btn btn-neutral float-left" title="Access Control Identifier (ACI)" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
<a href="../quotas.html" class="btn btn-neutral float-right" title="Quotas" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
</div>
<hr/>
<div role="contentinfo">
<p>© Copyright 1993–2025, The Cyrus Team.</p>
</div>
Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
<a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
provided by <a href="https://readthedocs.org">Read the Docs</a>.
</footer>
</div>
</div>
</section>
</div>
<script>
jQuery(function () {
SphinxRtdTheme.Navigation.enable(true);
});
</script>
</body>
</html>
|
