Scroll to navigation

NFS4_SETFACL(1) NFSv4 Access Control Lists NFS4_SETFACL(1)

NAME

nfs4_setfacl, nfs4_editfacl - manipulate NFSv4 file/directory access control lists

SYNOPSIS

nfs4_setfacl [OPTIONS] COMMAND file...
nfs4_editfacl [OPTIONS] file...

DESCRIPTION

nfs4_setfaclmanipulates the NFSv4 Access Control List (ACL) of one or morefiles(or directories), provided they are on a mounted NFSv4 filesystemwhich supports ACLs.

nfs4_editfaclis equivalent tonfs4_setfacl -e.

Refer to thenfs4_acl(5)manpage for information about NFSv4 ACL terminology and syntax.

COMMANDS

add the ACEs from acl_spec to file's ACL.ACEs are inserted starting at theindexthposition (DEFAULT: 1) offile's ACL.
add the ACEs from the acl_spec in acl_file to file's ACL.ACEs are inserted starting at theindexthposition (DEFAULT: 1) offile's ACL.
delete ACEs matched fromacl_spec- or delete theindexthACE - fromfile'sACL. Note that the ordering of the ACEs inacl_specdoes not matter.
delete ACEs matched from the acl_spec inacl_file from file's ACL.Note that the ordering of the ACEs in the acl_spec does not matter.
set file's ACL to acl_spec.
set file's ACL to the acl_spec in acl_file.
edit file's ACL in the editor defined in the EDITOR environment variable (DEFAULT: vi(1)) and set the resulting ACL upon a clean exit, assuming changes made in the editorwere saved. Note that if multiplefiles are specified, the editor will be serially invoked once per file.
modify file's ACL in-place by replacing from_ace with to_ace.
-?, -h, --help
display help text and exit.
display this program's version and exit.

NOTE: if '-' is given as the acl_filewith the -A/-X/-S flags, the acl_spec will be read from stdin.

OPTIONS

recursively apply to a directory's files and subdirectories. Similar tosetfacl(1),the default behavior is to follow symlinks given on the command line and to skip symlinksencountered while recursing through directories.
in conjunction with-R/--recursive, a logical walk follows all symbolic links.
in conjunction with-R/--recursive, a physical walk skips all symbolic links.
display results ofCOMMAND,but do not save changes.

PERMISSIONSALIASES

Withnfs4_setfacl,one can use simple abbreviations ("aliases") to express generic "read"(R),generic "write"(W),and generic "execute"(X)permissions,familiar from the POSIX mode bits used by, e.g.,chmod(1).To use these aliases, one can put them in thepermissionsfield of an NFSv4 ACE andnfs4_setfaclwill convert them: anRis expanded torntcy,aWis expanded towatTNcCy(withDadded to directory ACEs), and anXis expanded toxtcy.Please refer to thenfs4_acl(5)manpage for information on specific NFSv4 ACEpermissions.

For example, if one wanted to grant generic "read" and "write" access on a file, the NFSv4permissionsfield would normally contain something likerwatTnNcCy.Instead, one might use aliases to accomplish the same goal withRW.

The twopermissionsnot included in any of the aliases ared(delete) ando(write-owner). However, they can still be used: e.g., apermissionsfield consisting ofWdoexpresses generic "write" access as well as the ability to delete and change ownership.

EXAMPLES

Assume that the file `foo' has the following NFSv4 ACL for the following examples:

A::OWNER@:rwatTnNcCy
D::OWNER@:x
A:g:GROUP@:rtncy
D:g:GROUP@:waxTC
A::EVERYONE@:rtncy
D::EVERYONE@:waxTC
-
add ACE granting `alice@nfsdomain.org' generic "read" and "execute" access (defaults to prepending ACE to ACL):
$ nfs4_setfacl -a A::alice@nfsdomain.org:rxtncy foo
-
add the same ACE as above, but using aliases:
$ nfs4_setfacl -a A::alice@nfsdomain.org:RX foo
-
edit existing ACL in a text editor and set modified ACL on clean save/exit:
$ nfs4_setfacl -e foo
-
set ACL (overwrites original) to contents of aspec_filenamed `newacl.txt':
$ nfs4_setfacl -S newacl.txt foo
-
recursively set the ACLs of all files and subdirectories in the current directory, skippingall symlinks encountered, to the ACL contained in thespec_filenamed `newacl.txt':
$ nfs4_setfacl -R -P -S newacl.txt *
-
delete the first ACE, but only print the resulting ACL (does not save changes):
$ nfs4_setfacl --test -x 1 foo
-
delete the last two ACEs above:
$ nfs4_setfacl -x A::EVERYONE@rtncy,D::EVERYONE@:waxTC foo
-
modify (in-place) the second ACE above:
$ nfs4_setfacl -m D::OWNER@:x D::OWNER@:xo foo
-
set ACLs of `bar' and `frobaz' to ACL of `foo':
$ nfs4_getfacl foo | nfs4_setfacl -S - bar frobaz

AUTHORS

nfs4_setfaclwas written by people at CITI, the Center for Information Technology Integration(http://www.citi.umich.edu).This manpage was written by David Richter.

CONTACT

Please send bug reports, feature requests, and comments to<nfsv4@linux-nfs.org>.

SEEALSO

nfs4_getfacl(1), nfs4_acl(5),RFC3530 (NFSv4.0), NFSv4.1 Minor Version Draft.

version 0.3.4, August 2018 Linux