internal/acl: skip superfluous acl_set_file

This slightly reduces startup latency.

Signed-off-by: Ophestra <cat@gensokyo.uk>

8 files changed, 67 insertions, 70 deletions

diff --git a/internal/system/acl.go b/internal/system/acl.go
index e91f4eb7..7d34fa62 100644
--- a/internal/system/acl.go
+++ b/internal/system/acl.go
@@ -4,7 +4,6 @@ import (
 	"errors"
 	"fmt"
 	"os"
-	"slices"
 
 	"hakurei.app/check"
 	"hakurei.app/hst"
@@ -12,14 +11,14 @@ import (
 )
 
 // UpdatePerm calls UpdatePermType with the [Process] criteria.
-func (sys *I) UpdatePerm(path *check.Absolute, perms ...acl.Perm) *I {
-	sys.UpdatePermType(Process, path, perms...)
+func (sys *I) UpdatePerm(path *check.Absolute, perms acl.Perm) *I {
+	sys.UpdatePermType(Process, path, perms)
 	return sys
 }
 
 // UpdatePermType maintains [acl.Perms] on a file until its [hst.Enablements] is
 // no longer satisfied.
-func (sys *I) UpdatePermType(et hst.Enablements, path *check.Absolute, perms ...acl.Perm) *I {
+func (sys *I) UpdatePermType(et hst.Enablements, path *check.Absolute, perms acl.Perm) *I {
 	sys.ops = append(sys.ops, &aclUpdateOp{et, path.String(), perms})
 	return sys
 }
@@ -28,20 +27,20 @@ func (sys *I) UpdatePermType(et hst.Enablements, path *check.Absolute, perms ...
 type aclUpdateOp struct {
 	et    hst.Enablements
 	path  string
-	perms acl.Perms
+	perms acl.Perm
 }
 
 func (a *aclUpdateOp) Type() hst.Enablements { return a.et }
 
 func (a *aclUpdateOp) apply(sys *I) error {
 	sys.msg.Verbose("applying ACL", a)
-	return newOpError("acl", sys.aclUpdate(a.path, sys.uid, a.perms...), false)
+	return newOpError("acl", sys.aclUpdate(a.path, sys.uid, a.perms), false)
 }
 
 func (a *aclUpdateOp) revert(sys *I, ec *Criteria) error {
 	if ec.hasType(a.Type()) {
 		sys.msg.Verbose("stripping ACL", a)
-		err := sys.aclUpdate(a.path, sys.uid)
+		err := sys.aclUpdate(a.path, sys.uid, 0)
 		if errors.Is(err, os.ErrNotExist) {
 			// the ACL is effectively stripped if the file no longer exists
 			sys.msg.Verbosef("target of ACL %s no longer exists", a)
@@ -57,9 +56,7 @@ func (a *aclUpdateOp) revert(sys *I, ec *Criteria) error {
 func (a *aclUpdateOp) Is(o Op) bool {
 	target, ok := o.(*aclUpdateOp)
 	return ok && a != nil && target != nil &&
-		a.et == target.et &&
-		a.path == target.path &&
-		slices.Equal(a.perms, target.perms)
+		*a == *target
 }
 
 func (a *aclUpdateOp) Path() string { return a.path }
diff --git a/internal/system/acl_test.go b/internal/system/acl_test.go
index 01f9d9b1..a340e234 100644
--- a/internal/system/acl_test.go
+++ b/internal/system/acl_test.go
@@ -15,45 +15,45 @@ func TestACLUpdateOp(t *testing.T) {
 
 	checkOpBehaviour(t, 0, []opBehaviourTestCase{
 		{"apply aclUpdate", 0xbeef, 0xff,
-			&aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}, []stub.Call{
-				call("verbose", stub.ExpectArgs{[]any{"applying ACL", &aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}}}, nil, nil),
-				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, []acl.Perm{acl.Read, acl.Write, acl.Execute}}, nil, stub.UniqueError(1)),
+			&aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}, []stub.Call{
+				call("verbose", stub.ExpectArgs{[]any{"applying ACL", &aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}}}, nil, nil),
+				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, acl.Read | acl.Write | acl.Execute}, nil, stub.UniqueError(1)),
 			}, &OpError{Op: "acl", Err: stub.UniqueError(1)}, nil, nil},
 
 		{"revert aclUpdate", 0xbeef, 0xff,
-			&aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}, []stub.Call{
-				call("verbose", stub.ExpectArgs{[]any{"applying ACL", &aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}}}, nil, nil),
-				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, []acl.Perm{acl.Read, acl.Write, acl.Execute}}, nil, nil),
+			&aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}, []stub.Call{
+				call("verbose", stub.ExpectArgs{[]any{"applying ACL", &aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}}}, nil, nil),
+				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, acl.Read | acl.Write | acl.Execute}, nil, nil),
 			}, nil, []stub.Call{
-				call("verbose", stub.ExpectArgs{[]any{"stripping ACL", &aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}}}, nil, nil),
-				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, ([]acl.Perm)(nil)}, nil, stub.UniqueError(0)),
+				call("verbose", stub.ExpectArgs{[]any{"stripping ACL", &aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}}}, nil, nil),
+				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, acl.Perm(0)}, nil, stub.UniqueError(0)),
 			}, &OpError{Op: "acl", Err: stub.UniqueError(0), Revert: true}},
 
 		{"success revert skip", 0xbeef, Process,
-			&aclUpdateOp{User, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}, []stub.Call{
-				call("verbose", stub.ExpectArgs{[]any{"applying ACL", &aclUpdateOp{User, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}}}, nil, nil),
-				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, []acl.Perm{acl.Read, acl.Write, acl.Execute}}, nil, nil),
+			&aclUpdateOp{User, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}, []stub.Call{
+				call("verbose", stub.ExpectArgs{[]any{"applying ACL", &aclUpdateOp{User, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}}}, nil, nil),
+				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, acl.Read | acl.Write | acl.Execute}, nil, nil),
 			}, nil, []stub.Call{
-				call("verbose", stub.ExpectArgs{[]any{"skipping ACL", &aclUpdateOp{User, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{"skipping ACL", &aclUpdateOp{User, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}}}, nil, nil),
 			}, nil},
 
 		{"success revert aclUpdate ENOENT", 0xbeef, 0xff,
-			&aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}, []stub.Call{
-				call("verbose", stub.ExpectArgs{[]any{"applying ACL", &aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}}}, nil, nil),
-				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, []acl.Perm{acl.Read, acl.Write, acl.Execute}}, nil, nil),
+			&aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}, []stub.Call{
+				call("verbose", stub.ExpectArgs{[]any{"applying ACL", &aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}}}, nil, nil),
+				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, acl.Read | acl.Write | acl.Execute}, nil, nil),
 			}, nil, []stub.Call{
-				call("verbose", stub.ExpectArgs{[]any{"stripping ACL", &aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}}}, nil, nil),
-				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, ([]acl.Perm)(nil)}, nil, &os.PathError{Op: "acl_get_file", Path: "/proc/nonexistent", Err: syscall.ENOENT}),
-				call("verbosef", stub.ExpectArgs{"target of ACL %s no longer exists", []any{&aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}}}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{"stripping ACL", &aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}}}, nil, nil),
+				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, acl.Perm(0)}, nil, &os.PathError{Op: "acl_get_file", Path: "/proc/nonexistent", Err: syscall.ENOENT}),
+				call("verbosef", stub.ExpectArgs{"target of ACL %s no longer exists", []any{&aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}}}, nil, nil),
 			}, nil},
 
 		{"success", 0xbeef, 0xff,
-			&aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}, []stub.Call{
-				call("verbose", stub.ExpectArgs{[]any{"applying ACL", &aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}}}, nil, nil),
-				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, []acl.Perm{acl.Read, acl.Write, acl.Execute}}, nil, nil),
+			&aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}, []stub.Call{
+				call("verbose", stub.ExpectArgs{[]any{"applying ACL", &aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}}}, nil, nil),
+				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, acl.Read | acl.Write | acl.Execute}, nil, nil),
 			}, nil, []stub.Call{
-				call("verbose", stub.ExpectArgs{[]any{"stripping ACL", &aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{acl.Read, acl.Write, acl.Execute}}}}, nil, nil),
-				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, ([]acl.Perm)(nil)}, nil, nil),
+				call("verbose", stub.ExpectArgs{[]any{"stripping ACL", &aclUpdateOp{Process, "/proc/nonexistent", acl.Read | acl.Write | acl.Execute}}}, nil, nil),
+				call("aclUpdate", stub.ExpectArgs{"/proc/nonexistent", 0xbeef, acl.Perm(0)}, nil, nil),
 			}, nil},
 	})
 
@@ -63,28 +63,28 @@ func TestACLUpdateOp(t *testing.T) {
 			func(_ *testing.T, sys *I) {
 				sys.
 					UpdatePerm(m("/run/user/1971/hakurei"), acl.Execute).
-					UpdatePerm(m("/tmp/hakurei.0/tmpdir/150"), acl.Read, acl.Write, acl.Execute)
+					UpdatePerm(m("/tmp/hakurei.0/tmpdir/150"), acl.Read|acl.Write|acl.Execute)
 			}, []Op{
-				&aclUpdateOp{Process, "/run/user/1971/hakurei", []acl.Perm{acl.Execute}},
-				&aclUpdateOp{Process, "/tmp/hakurei.0/tmpdir/150", []acl.Perm{acl.Read, acl.Write, acl.Execute}},
+				&aclUpdateOp{Process, "/run/user/1971/hakurei", acl.Execute},
+				&aclUpdateOp{Process, "/tmp/hakurei.0/tmpdir/150", acl.Read | acl.Write | acl.Execute},
 			}, stub.Expect{}},
 
 		{"tmpdirp", 0xbeef, func(_ *testing.T, sys *I) {
 			sys.UpdatePermType(User, m("/tmp/hakurei.0/tmpdir"), acl.Execute)
 		}, []Op{
-			&aclUpdateOp{User, "/tmp/hakurei.0/tmpdir", []acl.Perm{acl.Execute}},
+			&aclUpdateOp{User, "/tmp/hakurei.0/tmpdir", acl.Execute},
 		}, stub.Expect{}},
 
 		{"tmpdir", 0xbeef, func(_ *testing.T, sys *I) {
-			sys.UpdatePermType(User, m("/tmp/hakurei.0/tmpdir/150"), acl.Read, acl.Write, acl.Execute)
+			sys.UpdatePermType(User, m("/tmp/hakurei.0/tmpdir/150"), acl.Read|acl.Write|acl.Execute)
 		}, []Op{
-			&aclUpdateOp{User, "/tmp/hakurei.0/tmpdir/150", []acl.Perm{acl.Read, acl.Write, acl.Execute}},
+			&aclUpdateOp{User, "/tmp/hakurei.0/tmpdir/150", acl.Read | acl.Write | acl.Execute},
 		}, stub.Expect{}},
 
 		{"share", 0xbeef, func(_ *testing.T, sys *I) {
 			sys.UpdatePermType(Process, m("/run/user/1971/hakurei/fcb8a12f7c482d183ade8288c3de78b5"), acl.Execute)
 		}, []Op{
-			&aclUpdateOp{Process, "/run/user/1971/hakurei/fcb8a12f7c482d183ade8288c3de78b5", []acl.Perm{acl.Execute}},
+			&aclUpdateOp{Process, "/run/user/1971/hakurei/fcb8a12f7c482d183ade8288c3de78b5", acl.Execute},
 		}, stub.Expect{}},
 
 		{"passwd", 0xbeef, func(_ *testing.T, sys *I) {
@@ -92,14 +92,14 @@ func TestACLUpdateOp(t *testing.T) {
 				UpdatePermType(Process, m("/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/passwd"), acl.Read).
 				UpdatePermType(Process, m("/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/group"), acl.Read)
 		}, []Op{
-			&aclUpdateOp{Process, "/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/passwd", []acl.Perm{acl.Read}},
-			&aclUpdateOp{Process, "/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/group", []acl.Perm{acl.Read}},
+			&aclUpdateOp{Process, "/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/passwd", acl.Read},
+			&aclUpdateOp{Process, "/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/group", acl.Read},
 		}, stub.Expect{}},
 
 		{"wayland", 0xbeef, func(_ *testing.T, sys *I) {
-			sys.UpdatePermType(hst.EWayland, m("/run/user/1971/wayland-0"), acl.Read, acl.Write, acl.Execute)
+			sys.UpdatePermType(hst.EWayland, m("/run/user/1971/wayland-0"), acl.Read|acl.Write|acl.Execute)
 		}, []Op{
-			&aclUpdateOp{hst.EWayland, "/run/user/1971/wayland-0", []acl.Perm{acl.Read, acl.Write, acl.Execute}},
+			&aclUpdateOp{hst.EWayland, "/run/user/1971/wayland-0", acl.Read | acl.Write | acl.Execute},
 		}, stub.Expect{}},
 	})
 
@@ -110,75 +110,75 @@ func TestACLUpdateOp(t *testing.T) {
 		{"et differs",
 			&aclUpdateOp{
 				hst.EWayland, "/run/user/1971/wayland-0",
-				[]acl.Perm{acl.Read, acl.Write, acl.Execute},
+				acl.Read | acl.Write | acl.Execute,
 			}, &aclUpdateOp{
 				hst.EX11, "/run/user/1971/wayland-0",
-				[]acl.Perm{acl.Read, acl.Write, acl.Execute},
+				acl.Read | acl.Write | acl.Execute,
 			}, false},
 
 		{"path differs", &aclUpdateOp{
 			hst.EWayland, "/run/user/1971/wayland-0",
-			[]acl.Perm{acl.Read, acl.Write, acl.Execute},
+			acl.Read | acl.Write | acl.Execute,
 		}, &aclUpdateOp{
 			hst.EWayland, "/run/user/1971/wayland-1",
-			[]acl.Perm{acl.Read, acl.Write, acl.Execute},
+			acl.Read | acl.Write | acl.Execute,
 		}, false},
 
 		{"perms differs", &aclUpdateOp{
 			hst.EWayland, "/run/user/1971/wayland-0",
-			[]acl.Perm{acl.Read, acl.Write, acl.Execute},
+			acl.Read | acl.Write | acl.Execute,
 		}, &aclUpdateOp{
 			hst.EWayland, "/run/user/1971/wayland-0",
-			[]acl.Perm{acl.Read, acl.Write},
+			acl.Read | acl.Write,
 		}, false},
 
 		{"equals", &aclUpdateOp{
 			hst.EWayland, "/run/user/1971/wayland-0",
-			[]acl.Perm{acl.Read, acl.Write, acl.Execute},
+			acl.Read | acl.Write | acl.Execute,
 		}, &aclUpdateOp{
 			hst.EWayland, "/run/user/1971/wayland-0",
-			[]acl.Perm{acl.Read, acl.Write, acl.Execute},
+			acl.Read | acl.Write | acl.Execute,
 		}, true},
 	})
 
 	checkOpMeta(t, []opMetaTestCase{
 		{"clear",
-			&aclUpdateOp{Process, "/proc/nonexistent", []acl.Perm{}},
+			&aclUpdateOp{Process, "/proc/nonexistent", 0},
 			Process, "/proc/nonexistent",
 			`--- type: process path: "/proc/nonexistent"`},
 
 		{"read",
-			&aclUpdateOp{User, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/0", []acl.Perm{acl.Read}},
+			&aclUpdateOp{User, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/0", acl.Read},
 			User, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/0",
 			`r-- type: user path: "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/0"`},
 
 		{"write",
-			&aclUpdateOp{User, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/1", []acl.Perm{acl.Write}},
+			&aclUpdateOp{User, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/1", acl.Write},
 			User, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/1",
 			`-w- type: user path: "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/1"`},
 
 		{"execute",
-			&aclUpdateOp{User, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/2", []acl.Perm{acl.Execute}},
+			&aclUpdateOp{User, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/2", acl.Execute},
 			User, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/2",
 			`--x type: user path: "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/2"`},
 
 		{"wayland",
-			&aclUpdateOp{hst.EWayland, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/wayland", []acl.Perm{acl.Read, acl.Write}},
+			&aclUpdateOp{hst.EWayland, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/wayland", acl.Read | acl.Write},
 			hst.EWayland, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/wayland",
 			`rw- type: wayland path: "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/wayland"`},
 
 		{"x11",
-			&aclUpdateOp{hst.EX11, "/tmp/.X11-unix/X0", []acl.Perm{acl.Read, acl.Execute}},
+			&aclUpdateOp{hst.EX11, "/tmp/.X11-unix/X0", acl.Read | acl.Execute},
 			hst.EX11, "/tmp/.X11-unix/X0",
 			`r-x type: x11 path: "/tmp/.X11-unix/X0"`},
 
 		{"dbus",
-			&aclUpdateOp{hst.EDBus, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/bus", []acl.Perm{acl.Write, acl.Execute}},
+			&aclUpdateOp{hst.EDBus, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/bus", acl.Write | acl.Execute},
 			hst.EDBus, "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/bus",
 			`-wx type: dbus path: "/tmp/hakurei.0/27d81d567f8fae7f33278eec45da9446/bus"`},
 
 		{"pulseaudio",
-			&aclUpdateOp{hst.EPulse, "/run/user/1971/hakurei/27d81d567f8fae7f33278eec45da9446/pulse", []acl.Perm{acl.Read, acl.Write, acl.Execute}},
+			&aclUpdateOp{hst.EPulse, "/run/user/1971/hakurei/27d81d567f8fae7f33278eec45da9446/pulse", acl.Read | acl.Write | acl.Execute},
 			hst.EPulse, "/run/user/1971/hakurei/27d81d567f8fae7f33278eec45da9446/pulse",
 			`rwx type: pulseaudio path: "/run/user/1971/hakurei/27d81d567f8fae7f33278eec45da9446/pulse"`},
 	})
diff --git a/internal/system/dispatcher.go b/internal/system/dispatcher.go
index 8f70b0c0..5a222176 100644
--- a/internal/system/dispatcher.go
+++ b/internal/system/dispatcher.go
@@ -50,7 +50,7 @@ type syscallDispatcher interface {
 	println(v ...any)
 
 	// aclUpdate provides [acl.Update].
-	aclUpdate(name string, uid int, perms ...acl.Perm) error
+	aclUpdate(name string, uid int, perms acl.Perm) error
 
 	// waylandNew provides [wayland.New].
 	waylandNew(displayPath, bindPath *check.Absolute, appID, instanceID string) (io.Closer, error)
@@ -85,8 +85,8 @@ func (k direct) remove(name string) error                  { return os.Remove(na
 
 func (k direct) println(v ...any) { log.Println(v...) }
 
-func (k direct) aclUpdate(name string, uid int, perms ...acl.Perm) error {
-	return acl.Update(name, uid, perms...)
+func (k direct) aclUpdate(name string, uid int, perms acl.Perm) error {
+	return acl.Update(name, uid, perms)
 }
 
 func (k direct) waylandNew(displayPath, bindPath *check.Absolute, appID, instanceID string) (io.Closer, error) {
diff --git a/internal/system/dispatcher_test.go b/internal/system/dispatcher_test.go
index 3bf14e75..6ffd0dfa 100644
--- a/internal/system/dispatcher_test.go
+++ b/internal/system/dispatcher_test.go
@@ -280,7 +280,7 @@ func (k *kstub) println(v ...any) {
 	}
 }
 
-func (k *kstub) aclUpdate(name string, uid int, perms ...acl.Perm) error {
+func (k *kstub) aclUpdate(name string, uid int, perms acl.Perm) error {
 	k.Helper()
 	expect := k.Expects("aclUpdate")
 
@@ -293,7 +293,7 @@ func (k *kstub) aclUpdate(name string, uid int, perms ...acl.Perm) error {
 	return expect.Error(
 		stub.CheckArgReflect(k.Stub, "name", nameVal, 0),
 		stub.CheckArg(k.Stub, "uid", uid, 1),
-		stub.CheckArgReflect(k.Stub, "perms", perms, 2))
+		stub.CheckArg(k.Stub, "perms", perms, 2))
 }
 
 func (k *kstub) waylandNew(displayPath, bindPath *check.Absolute, appID, instanceID string) (io.Closer, error) {
diff --git a/internal/system/pipewire.go b/internal/system/pipewire.go
index c2d7b396..427013a4 100644
--- a/internal/system/pipewire.go
+++ b/internal/system/pipewire.go
@@ -73,7 +73,7 @@ func (p *pipewireOp) apply(sys *I) (err error) {
 		return newOpError("pipewire", err, false)
 	}
 
-	if err = sys.aclUpdate(p.dst.String(), sys.uid, acl.Read, acl.Write, acl.Execute); err != nil {
+	if err = sys.aclUpdate(p.dst.String(), sys.uid, acl.Read|acl.Write|acl.Execute); err != nil {
 		if closeErr := p.scc.Close(); closeErr != nil {
 			return newOpError("pipewire", errors.Join(err, closeErr), false)
 		}
diff --git a/internal/system/pipewire_test.go b/internal/system/pipewire_test.go
index f0ca0b34..5953681e 100644
--- a/internal/system/pipewire_test.go
+++ b/internal/system/pipewire_test.go
@@ -423,7 +423,7 @@ func TestPipeWireOp(t *testing.T) {
 			call("verbosef", stub.ExpectArgs{"pipewire pathname socket on %q", []any{ignoreValue{}}}, nil, nil),
 
 			call("chmod", stub.ExpectArgs{ignoreValue{}, os.FileMode(0)}, nil, nil),
-			call("aclUpdate", stub.ExpectArgs{ignoreValue{}, 0xbeef, []acl.Perm{acl.Read, acl.Write, acl.Execute}}, nil, nil),
+			call("aclUpdate", stub.ExpectArgs{ignoreValue{}, 0xbeef, acl.Read | acl.Write | acl.Execute}, nil, nil),
 		}, nil, []stub.Call{
 			call("verbosef", stub.ExpectArgs{"hanging up pipewire socket on %q", []any{ignoreValue{}}}, nil, nil),
 		}, nil},
diff --git a/internal/system/wayland.go b/internal/system/wayland.go
index c22c3fdf..e86c3159 100644
--- a/internal/system/wayland.go
+++ b/internal/system/wayland.go
@@ -42,7 +42,7 @@ func (w *waylandOp) apply(sys *I) (err error) {
 			return newOpError("wayland", err, false)
 		}
 
-		if err = sys.aclUpdate(w.dst.String(), sys.uid, acl.Read, acl.Write, acl.Execute); err != nil {
+		if err = sys.aclUpdate(w.dst.String(), sys.uid, acl.Read|acl.Write|acl.Execute); err != nil {
 			if closeErr := w.ctx.Close(); closeErr != nil {
 				return newOpError("wayland", errors.Join(err, closeErr), false)
 			}
diff --git a/internal/system/wayland_test.go b/internal/system/wayland_test.go
index 76e6cc93..a9d29378 100644
--- a/internal/system/wayland_test.go
+++ b/internal/system/wayland_test.go
@@ -32,7 +32,7 @@ func TestWaylandOp(t *testing.T) {
 			call("waylandNew", stub.ExpectArgs{m("/run/user/1971/wayland-0"), m("/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland"), "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c"}, nil, nil),
 			call("verbosef", stub.ExpectArgs{"wayland pathname socket on %q via %q", []any{m("/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland"), m("/run/user/1971/wayland-0")}}, nil, nil),
 			call("chmod", stub.ExpectArgs{"/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland", os.FileMode(0)}, nil, nil),
-			call("aclUpdate", stub.ExpectArgs{"/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland", 0xbeef, []acl.Perm{acl.Read, acl.Write, acl.Execute}}, nil, stub.UniqueError(2)),
+			call("aclUpdate", stub.ExpectArgs{"/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland", 0xbeef, acl.Read | acl.Write | acl.Execute}, nil, stub.UniqueError(2)),
 		}, &OpError{Op: "wayland", Err: stub.UniqueError(2)}, nil, nil},
 
 		{"success", 0xbeef, 0xff, &waylandOp{nil,
@@ -44,7 +44,7 @@ func TestWaylandOp(t *testing.T) {
 			call("waylandNew", stub.ExpectArgs{m("/run/user/1971/wayland-0"), m("/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland"), "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c"}, nil, nil),
 			call("verbosef", stub.ExpectArgs{"wayland pathname socket on %q via %q", []any{m("/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland"), m("/run/user/1971/wayland-0")}}, nil, nil),
 			call("chmod", stub.ExpectArgs{"/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland", os.FileMode(0)}, nil, nil),
-			call("aclUpdate", stub.ExpectArgs{"/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland", 0xbeef, []acl.Perm{acl.Read, acl.Write, acl.Execute}}, nil, nil),
+			call("aclUpdate", stub.ExpectArgs{"/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland", 0xbeef, acl.Read | acl.Write | acl.Execute}, nil, nil),
 		}, nil, []stub.Call{
 			call("verbosef", stub.ExpectArgs{"hanging up wayland socket on %q", []any{m("/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland")}}, nil, nil),
 		}, nil},