# DHCPD ACL subsystem

### TARGETS:

The main goals of acl subsystem is providing a powerfull, flexible and extendable mechanism for access control of different objects in dhcpd configuration. This objects are shared networks, subnets, groups of hosts and hosts.
Also acl subsystem allows you to control some other features, such as: unique object names, applying of changed configuration, viewing and deletion of dhcp leasures.

### CONCEPTS:

Dhcpd configuration file we can show as a tree structure. Each node of this tree represents a configuration of different dhcp objects (fig. 0).

Acl subsystem have 2 levels of permissions:

- global: read, write, create;
- per-object: read, write.

Global permissions exists for every type of objects (hosts, groups, subnets, shared networks) and controls operations with a whole object set of given type.
Global create
Global read
Global write
Per-object permissions give you a more flexible way of access control. Per-object permissions acl exists for every object individual object. Today only hosts and subnets per-object acls are impemented.
Per-object read
Per-object write
Acl subsystem can operate in 4 different security levels (or modes).

### USER NOTES:

### DEVELOPER NOTES: