bac-rules

Business Access Control Rules - Rust workspace for modeling and evaluating access control systems.

Project: https://forge.fedoraproject.org/freeipa/bac-rules

Documentation

Read the full documentation book (build with mdbook)

Overview

This workspace contains Rust libraries for modeling and evaluating access control systems, covering RBAC, ABAC, HBAC, LDAP ACIs, POSIX ACLs, and Windows Security Descriptors.

Key Features:

• Algebraically-correct permissions - Based on lattice theory for sound permission composition
• High performance - Multi-layer optimization with caching, indexing, and bitmap-based evaluation
• Python bindings - PyO3 bindings (5 separate crates) with cross-module type sharing via Python capsules
• Policy composition - Combine ABAC with RBAC, or HBAC with RBAC, in four composition modes
• WASM support - WebAssembly packages for browser and Node.js environments
• Benchmarked - Performance tested with realistic workloads

Crates

Core Libraries

acls-rs

Algebraically-correct permissions system with RBAC, ABAC, and temporal support. Provides the foundational abstractions for access control.

• Minimal runtime dependencies (log, thiserror)
• Algebraic permission composition (Grant, Deny, lattice operations)
• RBAC policy with role hierarchy and conflict resolution
• Temporal permissions with time-based validity
• Subject type for user/entity representation

hbac-rs

FreeIPA Host-Based Access Control (HBAC) rule evaluation library. Implements FreeIPA's HBAC semantics on top of the acls-rs foundation.

• HBAC rule modeling and evaluation
• Three-dimensional matching (user, host, service)
• Category-based matching (all, specific items, groups)
• Group membership support
• Compatible with FreeIPA's pyhbac semantics
• High-performance bitmap-based deny index

abac-rs

Generic Attribute-Based Access Control (ABAC) evaluation engine with multi-layer optimization pipeline.

• Arbitrary attribute dimensions (not limited to user/host/service)
• Multi-type attributes (String, Integer, Float, IpAddr, IpCidr)
• Pluggable matchers for custom matching logic
• Multi-layer optimization (constant-result, bitmap deny index, LRU cache, Bloom filters, compiled evaluator)
• Policy composition with RBAC in four modes (And, Or, AbacFirst, RbacFirst)
• Thread-safe and single-threaded policy variants

ldap-acis

LDAP Access Control Instruction (ACI) parsing, evaluation, and generation for 389DS and OpenLDAP.

• ACI rule modeling built on acls-rs
• Bitmap deny index and Bloom filter optimization

posix-acls

POSIX.1e ACL modeling and evaluation built on acls-rs.

• POSIX ACL entry types (user, group, mask, other)
• ACL validation and effective permission calculation

win-sd

Windows Security Descriptor (MS-DTYP) modeling built on acls-rs.

• SDDL parsing and generation
• Access check evaluation with conditional ACEs
• Configurable PermissionMapping bridge for cross-platform translation

Parsers

ldif-parser

LDIF (RFC 2849) parser producing LdapEntry structures.

• Content and change LDIF record support
• Base64 attribute decoding

Python Bindings

Five separate crates providing PyO3 bindings with cross-module type sharing via Python capsules:

• acls-python (crates/acls-python)
• hbac-python (crates/hbac-python)
• abac-python (crates/abac-python)
• posix-acls-python (crates/posix-acls-python)
• win-sd-python (crates/win-sd-python)

bac-python-core

Shared core library providing C-compatible APIs for cross-module type sharing between Python extension modules.

• Defines API structures for RbacPolicy and Subject type sharing
• C-compatible function pointer interfaces using #[repr(C)]
• Enables abac-rs to accept types from acls-rs and hbac-rs via Python capsules

WASM

abac-wasm / hbac-wasm

WebAssembly bindings for browser and Node.js environments.

• TypeScript type definitions
• npm-compatible packages
• Zero-copy evaluation where possible

Supporting

perf-testing

Benchmark CLI (bac-perf) for performance testing all access control implementations.

bac-examples

Cross-crate examples demonstrating integration between libraries.

See individual crate READMEs for detailed documentation.

Building

# Build all crates
cargo build

# Run tests for all crates
cargo test

# Build specific crate
cargo build --package hbac-rs

# Run examples
cargo run -p bac-examples --example hbac_basic_usage
cargo run -p bac-examples --example posix_contractor_access
cargo run -p bac-examples --example nt_posix_translate
cargo run -p bac-examples --example ad_schema_access

Python Bindings

All five Python binding crates provide PyO3 bindings with seamless cross-module integration. Types like RbacPolicy and Subject can be shared between modules using Python capsules for efficient cross-module communication.

Installation

# Create a virtual environment (recommended)
python3 -m venv .venv
source .venv/bin/activate

# Install maturin
pip install maturin

# Install Python bindings in development mode
cd crates/acls-python && maturin develop
cd ../hbac-python && maturin develop
cd ../abac-python && maturin develop
cd ../posix-acls-python && maturin develop
cd ../win-sd-python && maturin develop

Basic Usage

from hbac_rs import HbacRuleBuilder, HbacRequest, HbacPolicy, Subject

# Create an HBAC rule using fluent API
rule = (HbacRuleBuilder("allow_ssh")
    .user("john")
    .host("web01.example.com")
    .service("sshd")
    .enabled(True)
    .build())

# Create a policy and evaluate
policy = HbacPolicy()
policy.add_rule(rule)

user = Subject("john")
request = HbacRequest(user, "web01.example.com", "sshd")

if policy.evaluate(request).is_allowed:
    print("Access granted!")

Policy Composition

Combine ABAC and RBAC policies:

from abac_rs import ComposedPolicy, CompositionMode, AbacRuleBuilder, AbacRequest, AttributeType
from acls_rs import RbacPolicy, Role, AtomicPermission
from hbac_rs import Subject

# Define ABAC rule
abac_rule = (AbacRuleBuilder("engineering_access")
    .dimension_values("department", [AttributeType.string("engineering")])
    .dimension_values("resource", [AttributeType.string("database")])
    .dimension_values("action", [AttributeType.string("read")])
    .enabled(True)
    .build())

# Define RBAC policy
rbac = RbacPolicy()
rbac.add_role(Role("developer", 
    grants=[AtomicPermission("database", "read")],
    denials=[]))

# Compose policies with AND mode
policy = ComposedPolicy([abac_rule], rbac, CompositionMode.and_mode())

# Evaluate request
user = Subject("alice")
user.add_group("developer")

request = AbacRequest()
request.add_attribute("department", AttributeType.string("engineering"), [])
request.add_attribute("resource", AttributeType.string("database"), [])
request.add_attribute("action", AttributeType.string("read"), [])

decision = policy.evaluate(request, user)
if decision.is_allowed:
    print("Access granted")

See the Python bindings documentation for complete API reference and examples.

Development

Local CI

Run the complete CI pipeline locally:

# Run all CI jobs
./scripts/local-ci.sh all

# Run specific jobs
./scripts/local-ci.sh build fmt clippy test

# Run Python-specific jobs
./scripts/local-ci.sh python python-examples

# See scripts/README.md for full documentation

Performance Testing

# Run comprehensive benchmark suite
./scripts/bench.sh

# Custom benchmark configuration
./scripts/bench.sh --rules 1000,10000 --scenarios throughput

# Compare performance between commits
./scripts/bench.sh --compare ~/.cache/bac-bench/baseline

# See scripts/README.md for full documentation

License

Licensed under either of:

• Apache License, Version 2.0
• MIT license

at your option.