in src/main/java/org/apache/sling/jcr/repoinit/impl/AclVisitor.java [88:103]
private void setRepositoryAcl(AclLine line, Session s, List<String> principals, List<String> privileges, AclLine.Action action) {
try {
if (action == AclLine.Action.REMOVE) {
report("remove not supported. use 'remove acl' instead.");
} else if (action == AclLine.Action.REMOVE_ALL) {
AclUtil.removeEntries(s, principals, Collections.singletonList(null));
} else {
final boolean isAllow = line.getAction().equals(AclLine.Action.ALLOW);
log.info("Adding repository level ACL '{}' entry '{}' for {}", isAllow ? "allow" : "deny", privileges, principals);
List<RestrictionClause> restrictions = line.getRestrictions();
AclUtil.setRepositoryAcl(s, principals, privileges, isAllow, restrictions);
}
} catch (Exception e) {
report(e, "Failed to set repository level ACL (" + e.toString() + ") " + line);
}
}