How to implement UNIX like ACL for table rows - sql

Question

I am new sql stuff so please forgive me for asking dumb question. I am creating my first real life application for college project.
At its core, It need to handle more than thousands of users which should not able to read or write to each others data unless given privileges. like Linux does with user and groups.
in below schema which I tried , a user can view(read) and edit(write) other users if they have read permissions.( r=2 w=1 r+w=3 ).
for example if cgroup_1 is admin and cgroup_2 is managers and unixperm is 32 then it means users in admin group can read+write(3) and users in managers group can only read(2)
create table cgroups
(
id int unsigned primary key auto_increment,
title varchar(100) not null unique,
cunixperm tinyint unsigned not null default 32 ,# r=2 w=1
cgroup_1 int unsigned not null default 1 references cgroups (id) on delete cascade on update cascade,
cgroup_2 int unsigned references cgroups (id) on delete cascade on update cascade
);
create table users
(
id int unsigned auto_increment primary key,
username varchar(255) not null unique,
cunixperm tinyint unsigned not null default 30, # r=2 w=1 3=r+w
cgroup_1 int unsigned default 1 not null references cgroups (id) on delete cascade on update cascade ,
cgroup_2 int unsigned references cgroups (id) on delete cascade on update cascade
);
create table many_users_in_many_cgroups
(
user_id int unsigned references users(id),
cgroup_id int unsigned references cgroups(id),
primary key (user_id,cgroup_id)
);
insert into cgroups(title)
values ('admins'),('managers'),('writers');
insert into users(username, cunixperm, cgroup_1, cgroup_2)
values ('user1',30,1,null),
('user2',30,1,2),
('user3',22,2,2),
('user4',02,3,3);
insert into many_users_in_many_cgroups
values (1,1),(2,2),(3,3),(4,4);
Now suppose user 2 has logged into my app, How can I only show the user rows where he has read (2) or read+write(3) permissions.
if above schema is not (probably) appropriate pls give me an example with appropriate scheme
I am currently using MariaDB but open for solutions for others too.

Answer 1

The short answer is: the control of access part is built into the application.
The mechanism must lie outside SQL, as SQL can (usually) only grant access on table level, not row or column.
As to how exactly to program it, one way would be this. Let's suppose you have a data table like this (I am using pseudo SQL, because I don't remember the exact Mysql syntax):
Create table data (
rowid unique auto-increment,
datafield text);
Create table data_acl(
rowid foreign key references data (rowid),
cgroup references cgroups(id),
permissions int);
This assumes all users are in some cgroup, so to give access to user you give access to cgroup. This makes it easier and follows the Unix idea of each user having his own group.
Your user table only needs to list user names.
Your cgroups table only needs to list user and group.
Create table cgroups (
Id autoincrement int,
name);
Create table cgroup_users (
user_id foreign key references users(id),
cgroup_id foreign key references cgroups(id)
);
Now to list all rows of data user has access to you just:
Select distinct datafield,acl.permissions from data d, data_acl acl, cgroups g
Where d.rowid=acl.rowid and acl.cgroup in (select distinct cgroup_id from cgroup_users where user_id=?)
Sorry for formatting, posting this from a mobile.