show ACL
node node1
primitive st stonith:ssh \
	params hostlist='node1' \
	meta target-role="Started" \
	op start requires=nothing timeout=60s \
	op monitor interval=60m timeout=60s
primitive d0 ocf:pacemaker:Dummy
primitive d1 ocf:pacemaker:Dummy
role basic-read \
	read status \
	read node attribute:uname \
	read node attribute:type \
	read property
role basic-read-basic \
	read cib
role d0-admin \
	write meta:d0:target-role \
	write meta:d0:is-managed \
	write location:d0 \
	read ref:d0
role silly-role \
	write meta:d0:target-role \
	write meta:d0:is-managed \
	write location:d0 \
	read ref:d0 \
	read status \
	read node attribute:uname \
	read node attribute:type \
	read utilization:d0 \
	write location:d0 \
	read property:stonith-enabled \
	write property \
	read node \
	read node:node1 \
	read nodeattr \
	read nodeattr:a1 \
	read nodeutil \
	read nodeutil:node1 \
	read status \
	read cib
role silly-role-2 \
	read xpath:"//nodes//attributes" \
	deny tag:nvpair \
	deny ref:d0 \
	deny tag:nvpair ref:d0
user alice \
	role:basic-read-basic
user bob \
	role:d0-admin \
	role:basic-read-basic
user cyrus \
	write meta:d0:target-role \
	write meta:d0:is-managed \
	write location:d0 \
	read ref:d0 \
	read status \
	read node attribute:uname \
	read node attribute:type \
	read property


_test
verify
.