Skip to content

Commit 4323852

Browse files
greg-ferrestyled-commits
authored andcommitted
doc: style edits and fixes to guides (#25461)
* doc: style edits and fixes to guides Edited the nRF Connect platform docs and the building guide for style. Fixed several linking issues. Signed-off-by: Grzegorz Ferenc <Grzegorz.Ferenc@nordicsemi.no> * Restyled by prettier-markdown --------- Signed-off-by: Grzegorz Ferenc <Grzegorz.Ferenc@nordicsemi.no> Co-authored-by: Restyled.io <commits@restyled.io>
1 parent 8dd8361 commit 4323852

10 files changed

+1040
-851
lines changed

docs/guides/BUILDING.md

+178-143
Large diffs are not rendered by default.

docs/guides/access-control-guide.md

+118-63
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,21 @@
11
# Access Control Guide
22

3-
All Interaction Model operations (read attribute, write attribute, invoke
4-
command, read event) are governed by access control, and will be denied (status
5-
0x7E Access Denied) if sufficient privilege for the operation is not obtained.
3+
All Interaction Model operations in Matter must be verified by the the Access
4+
Control mechanism.
5+
6+
Whenever a client device and a server device want to interact with one another
7+
by reading (or subscribing) attributes or events, writing attributes, or
8+
invoking commands, the Access Control mechanism must verify that the client has
9+
sufficient privileges to perform the operation on the server device.
10+
11+
If no sufficient privilege is obtained, the operation cannot take place and it
12+
is denied (status `0x7E Access Denied`).
13+
14+
This guide describes how the Access Control mechanism works and how it is
15+
implemented, and provides examples of Access Control Lists (ACLs) for different
16+
use cases.
17+
18+
<hr>
619

720
## Overview
821

@@ -24,82 +37,89 @@ node. It is these ACLs that govern which Interaction Model operations are
2437
allowed or denied on that server node, for subjects on the fabric, via CASE and
2538
group messaging.
2639

27-
## ACLs
40+
<hr>
2841

29-
ACLs are fabric-scoped data structures with the following fields:
42+
## Access Control Lists
3043

31-
- Privilege
32-
- AuthMode
33-
- Subjects
34-
- Targets
44+
Access Control Lists (ACLs) are fabric-scoped data structures with the following
45+
fields:
3546

36-
### Privilege
47+
- `Privilege`
48+
- `AuthMode`
49+
- `Subjects`
50+
- `Targets`
3751

38-
Privileges are:
52+
### Privilege field
53+
54+
The `Privilege` can be of the following types:
3955

4056
- View
4157
- Operate
4258
- Manage
4359
- Administer
4460

45-
An additional `ProxyView` privilege is not yet supported in the Matter SDK.
61+
> **Note:** An additional `ProxyView` privilege is not yet supported in the
62+
> Matter SDK.
4663
4764
By default, the `View` privilege is required to read attributes or events, and
4865
the `Operate` privilege is required to write attributes or invoke commands.
4966

50-
However, clusters may require stricter privileges for certain operations on
51-
certain endpoints. For example, the Access Control Cluster requires the
52-
`Administer` privilege for all its operations.
67+
Clusters may also require stricter privileges for certain operations on certain
68+
endpoints. For example, the Access Control Cluster requires the `Administer`
69+
privilege for all its operations.
5370

5471
If applicable, the ACL grants the privilege, and all less strict privileges
5572
subsumed by it. Therefore an ACL for `Manage` privilege will work for operations
5673
which require `Operate` or `View` privilege (but not `Administer` privilege).
5774

58-
### AuthMode
75+
### AuthMode field
5976

60-
Authentication modes are:
77+
The `AuthMode`, that is authentication modes, can be as follow:
6178

6279
- CASE
6380
- Group
6481

6582
The ACL applies only to subjects using that authentication mode.
6683

67-
### Subjects
84+
### Subjects field
6885

69-
Subjects is a list containing zero, one, or more subject identifiers, which are:
86+
The `Subjects` field is a list containing zero, one, or more subject
87+
identifiers, which are:
7088

71-
- Node ID for CASE auth mode
72-
- Group ID for Group auth mode
89+
- Node ID for CASE `AuthMode`
90+
- Group ID for Group `AuthMode`
7391

7492
A CASE subject may be a CAT, which has its own tag and version mechanism.
7593

7694
The ACL applies only to the listed subjects; if no subjects are listed, the ACL
7795
applies to any subjects using the authentication mode.
7896

79-
### Targets
97+
### Targets field
8098

81-
Targets is a list containing zero, one, or more structured entries with fields:
99+
The `Targets` field is a list containing zero, one, or more structured entries
100+
with fields:
82101

83102
- Cluster
84103
- Endpoint
85104
- DeviceType
86105

87106
All fields are nullable, but at least one must be present, and the endpoint and
88107
device type fields are mutually exclusive (only one of those two may be
89-
present).
90-
91-
If cluster is present, the ACL is targeted to just that cluster.
92-
93-
If endpoint is present, the ACL is targeted to just that endpoint.
108+
present):
94109

95-
If device type is present, the ACL is targeted to just endpoints which contain
96-
that device type (as reported by the Descriptor Cluster).
110+
- If cluster is present, the ACL is targeted to just that cluster.
111+
- If endpoint is present, the ACL is targeted to just that endpoint.
112+
- If device type is present, the ACL is targeted to just endpoints which
113+
contain that device type (as reported by the Descriptor Cluster).
97114

98-
Specifying device type in targets is not yet supported in the Matter SDK.
115+
> **Note:** Specifying device type in targets is not yet supported in the Matter
116+
> SDK.
99117
100118
The ACL applies only to the listed targets; if no targets are listed, the ACL
101119
applies to any targets on the server node.
102120

121+
<hr>
122+
103123
## Limitations and Restrictions
104124

105125
The Matter Specification states that a Matter implementation must support at
@@ -120,8 +140,12 @@ can be configured globally in `CHIPConfig.h` or per-app in
120140
- CHIP_CONFIG_EXAMPLE_ACCESS_CONTROL_MAX_SUBJECTS_PER_ENTRY
121141
- CHIP_CONFIG_EXAMPLE_ACCESS_CONTROL_MAX_TARGETS_PER_ENTRY
122142

143+
<hr>
144+
123145
## Case Studies
124146

147+
This section provides use case examples for different ACL scenarios.
148+
125149
### Single Administrator
126150

127151
A single controller commissions a server node, providing its own CASE node ID
@@ -174,17 +198,22 @@ Members of groups 123 and 456 are granted `Operate` privilege for the on/off
174198
cluster on any endpoint, any cluster on endpoint 1, and the level control
175199
cluster on endpoint 2.
176200

177-
## Managing ACLs Using Chip-Tool
201+
<hr>
202+
203+
## Managing ACLs using CHIP-Tool
178204

179205
### Usage
180206

207+
The following sections describe the requirements for managing ACLs using the
208+
CHIP-Tool.
209+
181210
#### Entire List
182211

183212
The Access Control Cluster's `ACL` attribute is a list.
184213

185-
Currently, list operations for single entries (append, update, delete) are not
186-
yet supported in the Matter SDK, so the entire list must be written to the
187-
attribute to change any ACL.
214+
> **Note:** Currently, list operations for single entries (append, update,
215+
> delete) are not yet supported in the Matter SDK, so the entire list must be
216+
> written to the attribute to change any ACL.
188217
189218
The write operation may employ multiple messages, making it unreliable. In any
190219
case, ACLs are updated as they are processed, and take effect immediately.
@@ -215,38 +244,45 @@ When reading ACLs, the proper fabric index is shown.
215244

216245
The tool requires numerical values for enums and identifiers.
217246

218-
The privileges are:
247+
- Privilege values:
219248

220-
- View: 1
221-
- Operate: 3
222-
- Manage: 4
223-
- Administer: 5
249+
- View: 1
250+
- Operate: 3
251+
- Manage: 4
252+
- Administer: 5
224253

225-
The authentication modes are:
254+
- AuthMode values:
226255

227-
- CASE: 2
228-
- Group: 3
256+
- CASE: 2
257+
- Group: 3
229258

230-
Some typical clusters:
259+
- Values for some typical clusters:
231260

232-
- On/Off: 6
233-
- Level Control: 8
234-
- Descriptor: 29
235-
- Binding: 30
236-
- Access Control: 31
237-
- Basic: 40
261+
- On/Off: 6
262+
- Level Control: 8
263+
- Descriptor: 29
264+
- Binding: 30
265+
- Access Control: 31
266+
- Basic: 40
238267

239268
### Examples
240269

241-
#### Automatically Installed ACL
270+
This section provides examples of commands and ACL output for different
271+
operations with the CHIP-Tool.
242272

243-
After commissioning with chip-tool, assuming `CaseAdminNode` is 112233, the
244-
automatically installed ACL is:
273+
#### Verification of the Automatically Installed ACL
274+
275+
During commissioning with the CHIP-Tool, an ACL that assigns Administer rights
276+
to the commissioner is automatically installed on the commissionee. This can be
277+
verified using the following command:
245278

246279
```
247280
out/debug/standalone/chip-tool accesscontrol read acl 1 0
248281
```
249282

283+
Assuming the `CaseAdminNode` value is `112233`, the ACL command output for this
284+
case is the following:
285+
250286
```
251287
Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000 DataVersion: 2578401031
252288
ACL: 1 entries
@@ -262,10 +298,15 @@ Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000 DataVersion: 2578401031
262298

263299
#### Installing a CASE ACL
264300

301+
The following command example requests the installation of a CASE ACL through a
302+
write interaction:
303+
265304
```
266305
out/debug/standalone/chip-tool accesscontrol write acl '[{"fabricIndex": 0, "privilege": 5, "authMode": 2, "subjects": [112233], "targets": null}, {"fabricIndex": 0, "privilege": 1, "authMode": 2, "subjects": [4444, 5555, 6666], "targets": null}]' 1 0
267306
```
268307

308+
The resulting ACL command output for this case can look like the following one:
309+
269310
```
270311
Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000 DataVersion: 2578401034
271312
ACL: 2 entries
@@ -291,10 +332,15 @@ Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000 DataVersion: 2578401034
291332

292333
#### Installing a Group ACL
293334

335+
The following command example requests the installation of a Group ACL through a
336+
write interaction:
337+
294338
```
295339
out/debug/standalone/chip-tool accesscontrol write acl '[{"fabricIndex": 0, "privilege": 5, "authMode": 2, "subjects": [112233], "targets": null}, {"fabricIndex": 0, "privilege": 1, "authMode": 2, "subjects": [4444, 5555, 6666], "targets": null}, {"fabricIndex": 0, "privilege": 3, "authMode": 3, "subjects": [123, 456], "targets": [{"cluster": 6, "endpoint": null, "deviceType": null}, {"cluster": null, "endpoint": 1, "deviceType": null}, {"cluster": 8, "endpoint": 2, "deviceType": null}]}]' 1 0
296340
```
297341

342+
The resulting ACL command output for this case can look like the following one:
343+
298344
```
299345
Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000DataVersion: 2578401041
300346
ACL: 3 entries
@@ -342,22 +388,28 @@ Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000DataVersion: 2578401041
342388
}
343389
```
344390

345-
## Managing ACLs Using Chip-Repl
391+
<hr>
392+
393+
## Managing ACLs Using Chip-repl
346394

347395
### Usage
348396

397+
This section provides examples of commands and ACL output for different
398+
operations with the CHIP-repl.
399+
349400
#### Entire List
350401

351-
See the important notes in the chip-tool section, as they also apply to
352-
chip-repl.
402+
See the important notes in the
403+
[Managing ACLs using CHIP-Tool](#managing-acls-using-chip-tool) section, as they
404+
also apply to the CHIP-repl.
353405

354406
### Null Fields
355407

356408
Null fields may be omitted.
357409

358-
OK: `Target(cluster=6, endpoint=Null, deviceType=Null)`
359-
360-
Also OK: `Target(cluster=6)`
410+
This means that the following entry is acceptable:
411+
`Target(cluster=6, endpoint=Null, deviceType=Null)`. Just as the following one:
412+
`Target(cluster=6)`.
361413

362414
The above assumes Target and Null are defined at global scope, which is not
363415
normally the case.
@@ -366,15 +418,15 @@ normally the case.
366418

367419
The `ACL` attribute is fabric-scoped, so each ACL has a fabric index.
368420

369-
The REPL ignores it when performing the actual write. Because null fields can be
370-
omitted, simply do not provide it when writing ACLs.
421+
The CHIP-repl ignores it when performing the actual write. Because null fields
422+
can be omitted, simply do not provide it when writing ACLs.
371423

372424
When reading ACLs, the proper fabric index is shown.
373425

374426
#### Enums and Identifiers
375427

376-
The REPL accepts numerical values for enums and identifiers, but it also accepts
377-
strongly typed values:
428+
The CHIP-repl accepts numerical values for enums and identifiers, but it also
429+
accepts strongly typed values:
378430

379431
The privileges are:
380432

@@ -399,6 +451,9 @@ Some typical clusters:
399451

400452
### Examples
401453

454+
This section provides examples of commands and ACL output for different
455+
operations with the CHIP-repl.
456+
402457
#### Automatically Installed ACL
403458

404459
After commissioning with chip-repl, assuming `CaseAdminNode` is 1, the

0 commit comments

Comments
 (0)