Copyright (c) 2014-2018 Dovecot authors, see the included COPYING file
DOVEADM-ACL 1 "2015-05-09" "Dovecot v2.3" "Dovecot"
NAME
doveadm-acl - Manage Access Control List (ACL) ------------------------------------------------------------------------
SYNOPSIS
doveadm " [" -Dv ] [-f formatter] acl command [ OPTIONS ] [ ARGUMENTS ] ------------------------------------------------------------------------
DESCRIPTION
The doveadm acl COMMANDS can be used to execute various Access Control List related actions. ------------------------------------------------------------------------
@INCLUDE:global-options-formatter@ --- command specific options --- "/.

This command uses by default the output formatter table .

Command specific options : -------------------------------------
@INCLUDE:option-A@ -------------------------------------
@INCLUDE:option-F-file@ -------------------------------------
@INCLUDE:option-S-socket@ -------------------------------------
@INCLUDE:option-u-user@ ------------------------------------------------------------------------

ARGUMENTS

id The id (identifier) is one of:

4 * group-override =\c group_name -----------------

* user =\c user_name -----------------

* owner -----------------

* group =\c group_name -----------------

* authenticated -----------------

* anyone " (or " anonymous ", which is an alias for anyone)" -----------------

The ACLs are processed in the precedence given above, so for example if you have given read-access to a group, you can still remove that from specific users inside the group.

Group-override identifier allows you to override users\(aq ACLs. Probably the most useful reason to do this is to temporarily disable access for some users. For example: 

user=timo rw
group-override=tempdisabled

Now if timo is a member of the tempdisabled group, he has no access to the mailbox. This wouldn\(aqt be possible with a normal group identifier, because the user=timo would override it.

-------------------------------------

mailbox The name of the mailbox, for which the ACL manipulation should be done. It\(aqs also possible to use the wildcard characters \(dq * "\(dq and/or \(dq" ? \(dq in the mailbox name. -------------------------------------

right Dovecot ACL right name. This isn\(aqt the same as the IMAP ACL letters, which aren\(aqt currently supported. Here is a mapping of the IMAP ACL letters to Dovecot ACL names:

4 l \(-> lookup Mailbox is visible in mailbox list. Mailbox can be subscribed to. -----------------

r \(-> read Mailbox can be opened for reading. -----------------

w \(-> write Message flags and keywords can be changed, except \(rsSeen " and " \(rsDeleted . -----------------

s \(-> write-seen \(rsSeen flag can be changed. -----------------

t \(-> write-deleted \(rsDeleted flag can be changed. -----------------

i \(-> insert Messages can be written or copied to the mailbox . -----------------

p \(-> post Messages can be posted to the mailbox by dovecot-lda , e.g. from Sieve scripts. -----------------

e \(-> expunge Messages can be expunged. -----------------

k \(-> create Mailboxes can be created/renamed directly under this mailbox (but not necessarily under its children, see ACL Inheritance in the wiki).

Note: Renaming also requires the delete right. -----------------

x \(-> delete Mailbox can be deleted. -----------------

a \(-> admin Administration rights to the mailbox (currently: ability to change ACLs for mailbox ).

------------------------------------------------------------------------
COMMANDS
acl add
doveadm acl add [-u user|-A|-F file] [-S socket_path] mailbox id right [ right " ...]"

Add ACL rights to the mailbox / id . If the id already exists, the existing rights are preserved. -------------------------------------

acl debug
doveadm acl debug [-u user|-A|-F file] [-S socket_path] mailbox

This command can be used to debug why a shared mailbox isn\(aqt accessible to the user. It will list exactly what the problem is. -------------------------------------

acl delete
doveadm acl delete [-u user|-A|-F file] [-S socket_path] mailbox id

Remove the whole ACL entry for the mailbox / id . -------------------------------------

acl get
doveadm acl get [-u user|-A|-F file] [-S socket_path] [ -m ] mailbox

Show all the ACLs for the mailbox . -------------------------------------

acl recalc
doveadm acl recalc [-u user|-A|-F file] [-S socket_path]

Make sure the user \(aqs shared mailboxes exist correctly in the acl_shared_dict . -------------------------------------

acl remove
doveadm acl remove [-u user|-A|-F file] [-S socket_path] mailbox id right [ right " ...]"

Remove the specified ACL rights from the mailbox / id . If all rights are removed, the entry still exists without any rights. -------------------------------------

acl rights
doveadm acl rights [-u user|-A|-F file] [-S socket_path] mailbox

Show the user \(aqs current ACL rights for the mailbox . -------------------------------------

acl set
doveadm acl set [-u user|-A|-F file] [-S socket_path] mailbox id right [ right " ...]"

Set ACL rights to the mailbox / id . If the id already exists, the existing rights are replaced. ------------------------------------------------------------------------
@INCLUDE:reporting-bugs@ ------------------------------------------------------------------------

SEE ALSO
doveadm (1), dovecot-lda (1) -------------------------------------

Additional resources:

"ACL Inheritance"
http://wiki2.dovecot.org/ACL#ACL_Inheritance