+"""
+ A General-purpose ACL mechanism.
+
+ [allow | deny] <type_of_object> <text_pattern>\r
+\r
+ "allow all" and "deny all" are shorthand for allowing or denying all objects.\r
+ Lines are executed from top to bottom until a match was found, typical\r
+ iptables style. An implicit 'deny all' exists at the bottom of the list.\r
+\r
+ For example,\r
+ allow site Max Planck Institute\r
+ deny site Arizona\r
+ allow region US\r
+ deny user scott@onlab.us\r
+ allow user *@onlab.us
+"""
+