title: How do i use the mask field in acl_entry table in Spring Security 3.1?
body: <p>I use the Spring Security 3.1 ACL implementation. So based on a tutorial i have created a acl databse with the following tables:</p>
  
  <pre><code>CREATE TABLE IF NOT EXISTS `acl_class` (
    `id` bigint(20) NOT NULL AUTO_INCREMENT,
    `class` varchar(255) NOT NULL,
    PRIMARY KEY (`id`),
    UNIQUE KEY `unique_uk_2` (`class`)
  ) ENGINE=InnoDB;
  
  CREATE TABLE IF NOT EXISTS `acl_entry` (
    `id` bigint(20) NOT NULL AUTO_INCREMENT,
    `acl_object_identity` bigint(20) NOT NULL,
    `ace_order` int(11) NOT NULL,
    `sid` bigint(20) NOT NULL,
    `mask` int(11) NOT NULL,
    `granting` tinyint(1) NOT NULL,
    `audit_success` tinyint(1) NOT NULL,
    `audit_failure` tinyint(1) NOT NULL,
    PRIMARY KEY (`id`),
    UNIQUE KEY `unique_uk_4` (`acl_object_identity`,`ace_order`),
    KEY `foreign_fk_5` (`sid`)
  ) ENGINE=InnoDB;
  
  CREATE TABLE IF NOT EXISTS `acl_object_identity` (
    `id` bigint(20) NOT NULL AUTO_INCREMENT,
    `object_id_class` bigint(20) NOT NULL,
    `object_id_identity` bigint(20) NOT NULL,
    `parent_object` bigint(20) DEFAULT NULL,
    `owner_sid` bigint(20) DEFAULT NULL,
    `entries_inheriting` tinyint(1) NOT NULL,
    PRIMARY KEY (`id`),
    UNIQUE KEY `unique_uk_3` (`object_id_class`,`object_id_identity`),
    KEY `foreign_fk_1` (`parent_object`),
    KEY `foreign_fk_3` (`owner_sid`)
  ) ENGINE=InnoDB;
  
  CREATE TABLE IF NOT EXISTS `acl_sid` (
    `id` bigint(20) NOT NULL AUTO_INCREMENT,
    `principal` tinyint(1) NOT NULL,
    `sid` varchar(100) NOT NULL,
    `password` varchar(255) NOT NULL,
    `salt` varchar(255) NOT NULL,
    PRIMARY KEY (`id`)
  ) ENGINE=InnoDB;
  </code></pre>
  
  <p>This works fine with Anntotations like:</p>
  
  <pre><code>@PreAuthorize("hasPermission(#element, 'WRITE')")
  @PostAuthorize("hasPermission(returnObject, 'READ')")
  </code></pre>
  
  <p>The rights "Read" and "Write" are set in the table acl_entry to the field mask. As i understood 1 means "READ", 2 means "Write", 4 means "Create", 8 means "Delete" and 16 means "Administer", because it seems to be a bitwise authentication method. </p>
  
  <ol>
  <li>Question: Do i have correctly understood the granting of rights?</li>
  <li>Question: How do i specify combined rights like "Read/Write"? Can i "set" the bit 0 (which is int 1) and 1 (which is int 2) so i get the mask value 1+2=3?</li>
  </ol>
  
  <p>Now i have to create single entries for the "READ" and "Write" permission, that's not pretty handy.</p>