ACL = whitelisting

I feel ACL is like whitelisting, ie, give some us开发者_StackOverflow中文版ers/groups some permission. Is this true?

yes

you can create list of user and where this user access to do some thing

also you can create list of group and assign access then create relation between user and groups

also see: http://en.wikipedia.org/wiki/Access_control_list