11 Classes [class]

11.8 Member access control [class.access]

11.8.1 General [class.access.general]

A member of a class can be

(1.1)
private, that is, it can be named only by members and friends of the class in which it is declared;
(1.2)
protected, that is, it can be named only by members and friends of the class in which it is declared, by classes derived from that class, and by their friends (see [class.protected]); or
(1.3)
public, that is, it can be named anywhere without access restriction.

[Note 1:

A constructor or destructor can be named by an expression ([basic.def.odr]) even though it has no name.

— end note]

A member of a class can also access all the members to which the class has access.

A local class of a member function may access the same members that the member function itself may access.101

Members of a class defined with the keyword class are private by default.

Members of a class defined with the keywords struct or union are public by default.

[Example 1: class X { int a; // X::a is private by default }; struct S { int a; // S::a is public by default }; — end example]

Access control is applied uniformly to declarations and expressions.

[Note 2:

Access control applies to members nominated by friend declarations ([class.friend]) and using-declarations ([namespace.udecl]).

— end note]

When a using-declarator is named, access control is applied to it, not to the declarations that replace it.

For an overload set, access control is applied only to the function selected by overload resolution.

[Example 2: struct S { void f(int); private: void f(double); }; void g(S* sp) { sp->f(2); // OK, access control applied after overload resolution } — end example]

[Note 3:

Because access control applies to the declarations named, if access control is applied to a typedef-name, only the accessibility of the typedef or alias declaration itself is considered.

The accessibility of the entity referred to by the typedef-name is not considered.

For example,

class A { class B { }; public: typedef B BB; }; void f() { A::BB x; // OK, typedef A::BB is public A::B y; // access error, A::B is private } — end note]

[Note 4:

Access control does not prevent members from being found by name lookup or implicit conversions to base classes from being considered.

— end note]

The interpretation of a given construct is established without regard to access control.

If the interpretation established makes use of inaccessible members or base classes, the construct is ill-formed.

All access controls in [class.access] affect the ability to name a class member from the declaration of a particular entity, including parts of the declaration preceding the name of the entity being declared and, if the entity is a class, the definitions of members of the class appearing outside the class's member-specification.

[Note 5:

This access also applies to implicit references to constructors, conversion functions, and destructors.

— end note]

[Example 3: class A { typedef int I; // private member I f(); friend I g(I); static I x; template<int> struct Q; template<int> friend struct R; protected: struct B { }; }; A::I A::f() { return 0; } A::I g(A::I p = A::x); A::I g(A::I p) { return 0; } A::I A::x = 0; template<A::I> struct A::Q { }; template<A::I> struct R { }; struct D: A::B, A { };

Here, all the uses of A::I are well-formed because A::f, A::x, and A::Q are members of class A and g and R are friends of class A.

This implies, for example, that access checking on the first use of A::I must be deferred until it is determined that this use of A::I is as the return type of a member of class A.

Similarly, the use of A::B as a base-specifier is well-formed because D is derived from A, so checking of base-specifiers must be deferred until the entire base-specifier-list has been seen.

— end example]

Access is checked for a default argument ([dcl.fct.default]) at the point of declaration, rather than at any points of use of the default argument.

Access checking for default arguments in function templates and in member functions of class templates is performed as described in [temp.inst].

Access for a default template-argument ([temp.param]) is checked in the context in which it appears rather than at any points of use of it.

[Example 4: class B { }; template <class T> class C { protected: typedef T TT; }; template <class U, class V = typename U::TT> class D : public U { }; D <C<B> >* d; // access error, C::TT is protected — end example]

101)101)

Access permissions are thus transitive and cumulative to nested and local classes.

11.8.2 Access specifiers [class.access.spec]

Member declarations can be labeled by an access-specifier ([class.derived]):

access-specifier : member-specification

_{o p t}

An access-specifier specifies the access rules for members following it until the end of the class or until another access-specifier is encountered.

[Example 1: class X { int a; // X::a is private by default: class used public: int b; // X::b is public int c; // X::c is public }; — end example]

Any number of access specifiers is allowed and no particular order is required.

[Example 2: struct S { int a; // S::a is public by default: struct used protected: int b; // S::b is protected private: int c; // S::c is private public: int d; // S::d is public }; — end example]

When a member is redeclared within its class definition, the access specified at its redeclaration shall be the same as at its initial declaration.

[Example 3: struct S { class A; enum E : int; private: class A { }; // error: cannot change access enum E: int { e0 }; // error: cannot change access }; — end example]

[Note 1:

In a derived class, the lookup of a base class name will find the injected-class-name instead of the name of the base class in the scope in which it was declared.

The injected-class-name might be less accessible than the name of the base class in the scope in which it was declared.

— end note]

[Example 4: class A { }; class B : private A { }; class C : public B { A* p; // error: injected-class-name A is inaccessible ::A* q; // OK }; — end example]

11.8.3 Accessibility of base classes and base class members [class.access.base]

If a class is declared to be a base class ([class.derived]) for another class using the public access specifier, the public members of the base class are accessible as public members of the derived class and protected members of the base class are accessible as protected members of the derived class.

If a class is declared to be a base class for another class using the protected access specifier, the public and protected members of the base class are accessible as protected members of the derived class.

If a class is declared to be a base class for another class using the private access specifier, the public and protected members of the base class are accessible as private members of the derived class.102

In the absence of an access-specifier for a base class, public is assumed when the derived class is defined with the class-key struct and private is assumed when the class is defined with the class-key class.

[Example 1: class B { /* ... */ }; class D1 : private B { /* ... */ }; class D2 : public B { /* ... */ }; class D3 : B { /* ... */ }; // B private by default struct D4 : public B { /* ... */ }; struct D5 : private B { /* ... */ }; struct D6 : B { /* ... */ }; // B public by default class D7 : protected B { /* ... */ }; struct D8 : protected B { /* ... */ };

Here B is a public base of D2, D4, and D6, a private base of D1, D3, and D5, and a protected base of D7 and D8.

— end example]

[Note 1:

A member of a private base class can be inaccessible as inherited, but accessible directly.

Because of the rules on pointer conversions ([conv.ptr]) and explicit casts ([expr.type.conv], [expr.static.cast], [expr.cast]), a conversion from a pointer to a derived class to a pointer to an inaccessible base class can be ill-formed if an implicit conversion is used, but well-formed if an explicit cast is used.

For example,

class B { public: int mi; // non-static member static int si; // static member }; class D : private B { }; class DD : public D { void f(); }; void DD::f() { mi = 3; // error: mi is private in D si = 3; // error: si is private in D ::B b; b.mi = 3; // OK (b.mi is different from this->mi) b.si = 3; // OK (b.si is different from this->si) ::B::si = 3; // OK ::B* bp1 = this; // error: B is a private base class ::B* bp2 = (::B*)this; // OK with cast bp2->mi = 3; // OK, access through a pointer to B. } — end note]

A base class B of N is accessible at R, if

(4.1)
an invented public member of B would be a public member of N, or
(4.2)
R occurs in a direct member or friend of class N, and an invented public member of B would be a private or protected member of N, or
(4.3)
R occurs in a direct member or friend of a class P derived from N, and an invented public member of B would be a private or protected member of P, or
(4.4)
there exists a class S such that B is a base class of S accessible at R and S is a base class of N accessible at R.

[Example 2: class B { public: int m; }; class S: private B { friend class N; }; class N: private S { void f() { B* p = this; // OK because class S satisfies the fourth condition above: B is a base class of N // accessible in f() because B is an accessible base class of S and S is an accessible // base class of N. } }; — end example]

If a base class is accessible, one can implicitly convert a pointer to a derived class to a pointer to that base class ([conv.ptr], [conv.mem]).

[Note 2:

It follows that members and friends of a class X can implicitly convert an X* to a pointer to a private or protected immediate base class of X.

— end note]

The access to a member is affected by the class in which the member is named.

This naming class is the class in whose scope name lookup performed a search that found the member.

[Note 3:

This class can be explicit, e.g., when a qualified-id is used, or implicit, e.g., when a class member access operator ([expr.ref]) is used (including cases where an implicit “this->” is added).

If both a class member access operator and a qualified-id are used to name the member (as in p->T::m), the class naming the member is the class denoted by the nested-name-specifier of the qualified-id (that is, T).

— end note]

A member m is accessible at the point R when named in class N if

(5.1)
m as a member of N is public, or
(5.2)
m as a member of N is private, and R occurs in a direct member or friend of class N, or
(5.3)
m as a member of N is protected, and R occurs in a direct member or friend of class N, or in a member of a class P derived from N, where m as a member of P is public, private, or protected, or
(5.4)
there exists a base class B of N that is accessible at R, and m is accessible at R when named in class B.
[Example 3: class B; class A { private: int i; friend void f(B*); }; class B : public A { }; void f(B* p) { p->i = 1; // OK, B* can be implicitly converted to A*, and f has access to i in A } — end example]

If a class member access operator, including an implicit “this->”, is used to access a non-static data member or non-static member function, the reference is ill-formed if the left operand (considered as a pointer in the “.” operator case) cannot be implicitly converted to a pointer to the naming class of the right operand.

[Note 4:

This requirement is in addition to the requirement that the member be accessible as named.

— end note]

102)102)

As specified previously in [class.access], private members of a base class remain inaccessible even to derived classes unless friend declarations within the base class definition are used to grant access explicitly.

11.8.4 Friends [class.friend]

A friend of a class is a function or class that is given permission to name the private and protected members of the class.

A class specifies its friends, if any, by way of friend declarations.

Such declarations give special access rights to the friends, but they do not make the nominated friends members of the befriending class.

[Example 1:

The following example illustrates the differences between members and friends: class X { int a; friend void friend_set(X*, int); public: void member_set(int); }; void friend_set(X* p, int i) { p->a = i; } void X::member_set(int i) { a = i; } void f() { X obj; friend_set(&obj,10); obj.member_set(10); }

— end example]

Declaring a class to be a friend implies that private and protected members of the class granting friendship can be named in the base-specifiers and member declarations of the befriended class.

[Example 2: class A { class B { }; friend class X; }; struct X : A::B { // OK, A::B accessible to friend A::B mx; // OK, A::B accessible to member of friend class Y { A::B my; // OK, A::B accessible to nested member of friend }; }; — end example]

[Example 3: class X { enum { a=100 }; friend class Y; }; class Y { int v[X::a]; // OK, Y is a friend of X }; class Z { int v[X::a]; // error: X::a is private }; — end example]

A friend declaration that does not declare a function shall have one of the following forms:

friend elaborated-type-specifier ;
friend simple-type-specifier ;
friend typename-specifier ;

[Note 1:

A friend declaration can be the declaration in a template-declaration ([temp.pre], [temp.friend]).

— end note]

If the type specifier in a friend declaration designates a (possibly cv-qualified) class type, that class is declared as a friend; otherwise, the friend declaration is ignored.

[Example 4: class C; typedef C Ct; class X1 { friend C; // OK, class C is a friend }; class X2 { friend Ct; // OK, class C is a friend friend D; // error: D not found friend class D; // OK, elaborated-type-specifier declares new class }; template <typename T> class R { friend T; }; R<C> rc; // class C is a friend of R<C> R<int> Ri; // OK, "friend int;" is ignored — end example]

A function first declared in a friend declaration has the linkage of the namespace of which it is a member ([basic.link]).

Otherwise, the function retains its previous linkage ([dcl.stc]).

[Note 2:

A friend declaration refers to an entity, not (all overloads of) a name.

A member function of a class X can be a friend of a class Y.

[Example 5: class Y { friend char* X::foo(int); friend X::X(char); // constructors can be friends friend X::~X(); // destructors can be friends }; — end example]

— end note]

A function may be defined in a friend declaration of a class if and only if the class is a non-local class ([class.local]) and the function name is unqualified.

[Example 6: class M { friend void f() { } // definition of global f, a friend of M, // not the definition of a member function }; — end example]

Such a function is implicitly an inline ([dcl.inline]) function if it is attached to the global module.

[Note 3:

If a friend function is defined outside a class, it is not in the scope of the class.

— end note]

No storage-class-specifier shall appear in the decl-specifier-seq of a friend declaration.

A member nominated by a friend declaration shall be accessible in the class containing the friend declaration.

The meaning of the friend declaration is the same whether the friend declaration appears in the private, protected, or public ([class.mem]) portion of the class member-specification.

Friendship is neither inherited nor transitive.

[Example 7: class A { friend class B; int a; }; class B { friend class C; }; class C { void f(A* p) { p->a++; // error: C is not a friend of A despite being a friend of a friend } }; class D : public B { void f(A* p) { p->a++; // error: D is not a friend of A despite being derived from a friend } }; — end example]

[Note 4:

A friend declaration never binds any names ([dcl.meaning], [dcl.type.elab]).

— end note]

[Example 8: // Assume f and g have not yet been declared. void h(int); template <class T> void f2(T); namespace A { class X { friend void f(X); // A::f(X) is a friend class Y { friend void g(); // A::g is a friend friend void h(int); // A::h is a friend // ::h not considered friend void f2<>(int); // ::f2<>(int) is a friend }; }; // A::f, A::g and A::h are not visible here X x; void g() { f(x); } // definition of A::g void f(X) { /* ... */ } // definition of A::f void h(int) { /* ... */ } // definition of A::h // A::f, A::g and A::h are visible here and known to be friends } using A::x; void h() { A::f(x); A::X::f(x); // error: f is not a member of A::X A::X::Y::g(); // error: g is not a member of A::X::Y } — end example]

[Example 9: class X; void a(); void f() { class Y; extern void b(); class A { friend class X; // OK, but X is a local class, not ::X friend class Y; // OK friend class Z; // OK, introduces local class Z friend void a(); // error, ::a is not considered friend void b(); // OK friend void c(); // error }; X* px; // OK, but ::X is found Z* pz; // error: no Z is found } — end example]

11.8.5 Protected member access [class.protected]

An additional access check beyond those described earlier in [class.access] is applied when a non-static data member or non-static member function is a protected member of its naming class ([class.access.base]).103

As described earlier, access to a protected member is granted because the reference occurs in a friend or direct member of some class C.

If the access is to form a pointer to member ([expr.unary.op]), the nested-name-specifier shall denote C or a class derived from C.

All other accesses involve a (possibly implicit) object expression ([expr.ref]).

In this case, the class of the object expression shall be C or a class derived from C.

[Example 1: class B { protected: int i; static int j; }; class D1 : public B { }; class D2 : public B { friend void fr(B*,D1*,D2*); void mem(B*,D1*); }; void fr(B* pb, D1* p1, D2* p2) { pb->i = 1; // error p1->i = 2; // error p2->i = 3; // OK (access through a D2) p2->B::i = 4; // OK (access through a D2, even though naming class is B) int B::* pmi_B = &B::i; // error int B::* pmi_B2 = &D2::i; // OK (type of &D2::i is int B::*) B::j = 5; // error: not a friend of naming class B D2::j = 6; // OK (because refers to static member) } void D2::mem(B* pb, D1* p1) { pb->i = 1; // error p1->i = 2; // error i = 3; // OK (access through this) B::i = 4; // OK (access through this, qualification ignored) int B::* pmi_B = &B::i; // error int B::* pmi_B2 = &D2::i; // OK j = 5; // OK (because j refers to static member) B::j = 6; // OK (because B::j refers to static member) } void g(B* pb, D1* p1, D2* p2) { pb->i = 1; // error p1->i = 2; // error p2->i = 3; // error } — end example]

103)103)

This additional check does not apply to other members, e.g., static data members or enumerator member constants.

11.8.6 Access to virtual functions [class.access.virt]

The access rules ([class.access]) for a virtual function are determined by its declaration and are not affected by the rules for a function that later overrides it.

[Example 1: class B { public: virtual int f(); }; class D : public B { private: int f(); }; void f() { D d; B* pb = &d; D* pd = &d; pb->f(); // OK, B::f() is public, D::f() is invoked pd->f(); // error: D::f() is private } — end example]

Access is checked at the call point using the type of the expression used to denote the object for which the member function is called (B* in the example above).

The access of the member function in the class in which it was defined (D in the example above) is in general not known.

11.8.7 Multiple access [class.paths]

If a declaration can be reached by several paths through a multiple inheritance graph, the access is that of the path that gives most access.

[Example 1: class W { public: void f(); }; class A : private virtual W { }; class B : public virtual W { }; class C : public A, public B { void f() { W::f(); } // OK };

Since W::f() is available to C::f() along the public path through B, access is allowed.

— end example]

11.8.8 Nested classes [class.access.nest]

A nested class is a member and as such has the same access rights as any other member.

The members of an enclosing class have no special access to members of a nested class; the usual access rules ([class.access]) shall be obeyed.

[Example 1: class E { int x; class B { }; class I { B b; // OK, E::I can access E::B int y; void f(E* p, int i) { p->x = i; // OK, E::I can access E::x } }; int g(I* p) { return p->y; // error: I::y is private } }; — end example]