code: public AclActions getPermission(String user, List<String> groups) {
      if (user.equals(mOwningUser)) {
        return new AclActions(getOwningUserActions());
      }
      if (hasExtended()) {
        AclActions actions = mExtendedEntries.getNamedUser(user);
        if (actions != null) {
          AclActions result = new AclActions(actions);
          result.mask(mExtendedEntries.mMaskActions);
          return result;
        }
      }
  
      boolean isGroupKnown = false;
      AclActions groupActions = new AclActions();
      if (groups.contains(mOwningGroup)) {
        isGroupKnown = true;
        groupActions.merge(getOwningGroupActions());
      }
      if (hasExtended()) {
        for (String group : groups) {
          AclActions actions = mExtendedEntries.getNamedGroup(group);
          if (actions != null) {
            isGroupKnown = true;
            groupActions.merge(actions);
          }
        }
      }
      if (isGroupKnown) {
        if (hasExtended()) {
          groupActions.mask(mExtendedEntries.mMaskActions);
        }
        return groupActions;
      }
  
      return getOtherActions();
    }
docs: Gets the permitted actions for a user.
  
  When AccessControlList is not modified after calling getPermission,
  for each action returned by this method, checkPermission(user, groups, action) is true,
  for other actions, checkPermission(user, groups, action) is false.
  
  1. If the user is the owner, then return the permission in the owner entry;
  2. Else if the user matches the name of one of the named user entries, then return the AND
  result of the permission in this entry and the mask ;
  3. Else if at least one of the groups is the owning group or matches the name of one of the
  named group entries, then for the named group entries that match a member of groups, merge
  the permissions in these entries and return the merged permission ANDed with the mask;
  4. Otherwise, return the permission in the other entry.
  
  @param user the user
  @param groups the groups the user belongs to
  @return the permitted actions