def _build_acl_from_principals(principals, action_obj, req_permission):
    """ Build ACL with 'all' and `req_permission` permissions for which
    of :principals: controlled by :action_obj:.

    :param principals: List of valid Pyramid ACL principals for
        which ACL should be built.
    :param action_obj: Pyramid ACL action object (Allow, Deny) which
        should be used in all ACEs of ACL.
    :param req_permission: Requested permission which is used to
        perform ACL filtering.
    :return: Valid Pyramid ACL.
    """
    from pyramid.security import ALL_PERMISSIONS
    acl = []
    for ident in principals:
        acl += [(action_obj, ident, ALL_PERMISSIONS), (action_obj, ident,
            req_permission)]
    return acl
