'Creates a CheckAccessHelper for controlling read access.
This function and _CreateQueryAccessHelper essentially define GRR\'s ACL
policy. Please refer to these 2 functions to either review or modify
GRR\'s ACLs.
Read access gives you the ability to open and read aff4 objects for which
you already have the URN.
Returns:
CheckAccessHelper for controlling read access.'

def _CreateReadAccessHelper(self):

    h = CheckAccessHelper('read')
    h.Allow('aff4:/')
    h.Allow('aff4:/users')
    h.Allow('aff4:/users/*', self._IsHomeDir)
    h.Allow('aff4:/foreman', self._UserHasAdminLabel)
    h.Allow('aff4:/blobs')
    h.Allow('aff4:/blobs/*')
    h.Allow('aff4:/FP')
    h.Allow('aff4:/FP/*')
    h.Allow('aff4:/files')
    h.Allow('aff4:/files/*')
    h.Allow('aff4:/index')
    h.Allow('aff4:/index/*')
    h.Allow('aff4:/client_index')
    h.Allow('aff4:/client_index/*')
    h.Allow('aff4:/ACL')
    h.Allow('aff4:/ACL/*')
    h.Allow('aff4:/stats')
    h.Allow('aff4:/stats/*')
    h.Allow('aff4:/stats/FileStoreStats')
    h.Allow('aff4:/stats/FileStoreStats/*')
    h.Allow('aff4:/config')
    h.Allow('aff4:/config/*')
    h.Allow('aff4:/flows')
    h.Allow('aff4:/flows/*')
    h.Allow('aff4:/hunts')
    h.Allow('aff4:/hunts/*')
    h.Allow('aff4:/cron')
    h.Allow('aff4:/cron/*')
    h.Allow('aff4:/audit')
    h.Allow('aff4:/audit/*')
    h.Allow('aff4:/audit/logs')
    h.Allow('aff4:/audit/logs/*')
    h.Allow(self.CLIENT_URN_PATTERN)
    h.Allow((self.CLIENT_URN_PATTERN + '/*'), self._HasAccessToClient)
    h.Allow('aff4:/tmp')
    h.Allow('aff4:/tmp/*')
    h.Allow('aff4:/artifact_store')
    h.Allow('aff4:/artifact_store/*')
    h.Allow('aff4:/stats_store')
    h.Allow('aff4:/stats_store/*')
    return h
