// This function is from develop.apple.com
// it is part of a longer code sample
//	documenting the use of the acl API.

// create an ACL with a single ACE which allows the current user to read the object
static acl_t CreateReadOnlyForCurrentUserACL(void)
{
  acl_t  theACL = NULL;
  uuid_t  theUUID;
  int    result;
  
  result =  mbr_uid_to_uuid(geteuid(), theUUID);  // need the uuid for the ACE
  if (result == 0)
  {
    theACL = acl_init(1);  // create an empty ACL
    if (theACL)
    {
      Boolean freeACL = true;
      acl_entry_t newEntry;
      acl_permset_t newPermSet;

      result = acl_create_entry_np(&theACL, &newEntry, ACL_FIRST_ENTRY);
      if (result == 0)
      {  // allow
        result = acl_set_tag_type(newEntry, ACL_EXTENDED_ALLOW);
        if (result == 0)
        {  // the current user
          result = acl_set_qualifier(newEntry, (const void *)theUUID);
          if (result == 0)
          {
            result = acl_get_permset(newEntry, &newPermSet);
            if (result == 0)
            {  // to read data
              result = acl_add_perm(newPermSet, ACL_READ_DATA);
              if (result == 0)
              {  
                result = acl_set_permset(newEntry, newPermSet);
                if (result == 0)
                  freeACL = false;  // all set up and ready to go
              }
            }
          }
        }
      }
    
      if (freeACL)
      {
        acl_free(theACL);
        theACL = NULL;
      }
    }
  }
  return theACL;
}