NAME
nfs4setfacl, nfs4editfacl - manipulate NFSv4 file/directory access control lists SYNOPSIS nfs4setfacl [OPTIONS] COMMAND file... nfs4editfacl [OPTIONS] file... DESCRIPTION nfs4setfacl manipulates the NFSv4 Access Control List (ACL) of one or more files (or directories), provided they are on a mounted NFSv4 filesystem which supports ACLs.
nfs4editfacl is equivalent to nfs4setfacl -e. Refer to the nfs4acl(5) manpage for information about NFSv4 ACL termi‐ nology and syntax. COMMANDS
-a aclspec [index] add the ACEs from aclspec to file's ACL. ACEs are inserted starting at the indexth position (DEFAULT: 1) of file's ACL.
-A aclfile [index] add the ACEs from the aclspec in aclfile to file's ACL. ACEs are inserted starting at the indexth position (DEFAULT: 1) of file's ACL.
-x aclspec | index
delete ACEs matched from aclspec - or delete the indexth ACE - from file's ACL. Note that the ordering of the ACEs in aclspec does not matter.
-X aclfile delete ACEs matched from the aclspec in aclfile from file's ACL. Note that the ordering of the ACEs in the aclspec does not matter.
-s aclspec set file's ACL to aclspec.
-S aclfile set file's ACL to the aclspec in aclfile.
-e, edit edit file's ACL in the editor defined in the EDITOR environment variable (DEFAULT: vi(1)) and set the resulting ACL upon a clean exit, assuming changes made in the editor were saved. Note that if multiple files are specified, the editor will be serially invoked once per file.
-m fromace toace
modify file's ACL in-place by replacing fromace with toace.
-?, -h, help display help text and exit. version display this program's version and exit.
NOTE: if '-' is given as the aclfile with the -A/-X/-S flags, the aclspec will be read from stdin. OPTIONS
-R, recursive recursively apply to a directory's files and subdirectories. Similar to setfacl(1), the default behavior is to follow sym‐ links given on the command line and to skip symlinks encountered while recursing through directories.
-L, logical
in conjunction with -R/recursive, a logical walk follows all symbolic links.
-P, physical
in conjunction with -R/recursive, a physical walk skips all symbolic links. test display results of COMMAND, but do not save changes. PERMISSIONS ALIASES With nfs4setfacl, one can use simple abbreviations ("aliases") to express generic "read" (R), generic "write" (W), and generic "execute" (X) permissions, familiar from the POSIX mode bits used by, e.g., chmod(1). To use these aliases, one can put them in the permissions field of an NFSv4 ACE and nfs4setfacl will convert them: an R is expanded to rntcy, a W is expanded to watTNcCy (with D added to direc‐ tory ACEs), and an X is expanded to xtcy. Please refer to the nfs4acl(5) manpage for information on specific NFSv4 ACE permissions. For example, if one wanted to grant generic "read" and "write" access on a file, the NFSv4 permissions field would normally contain something like rwatTnNcCy. Instead, one might use aliases to accomplish the same goal with RW. The two permissions not included in any of the aliases are d (delete)
and o (write-owner). However, they can still be used: e.g., a permis‐ sions field consisting of Wdo expresses generic "write" access as well as the ability to delete and change ownership. EXAMPLES Assume that the file `foo' has the following NFSv4 ACL for the follow‐ ing examples: A::OWNER@:rwatTnNcCy D::OWNER@:x A:g:GROUP@:rtncy D:g:GROUP@:waxTC A::EVERYONE@:rtncy D::EVERYONE@:waxTC
- add ACE granting `alice@nfsdomain.org' generic "read" and "execute" access (defaults to prepending ACE to ACL):
$ nfs4setfacl -a A::alice@nfsdomain.org:rxtncy foo
- add the same ACE as above, but using aliases:
$ nfs4setfacl -a A::alice@nfsdomain.org:RX foo
- edit existing ACL in a text editor and set modified ACL on clean save/exit:
$ nfs4setfacl -e foo
- set ACL (overwrites original) to contents of a specfile named `newacl.txt':
$ nfs4setfacl -S newacl.txt foo
- recursively set the ACLs of all files and subdirectories in the cur‐ rent directory, skipping all symlinks encountered, to the ACL con‐ tained in the specfile named `newacl.txt':
$ nfs4setfacl -R -P -S newacl.txt *
- delete the first ACE, but only print the resulting ACL (does not save changes):
$ nfs4setfacl test -x 1 foo
- delete the last two ACEs above:
$ nfs4setfacl -x A::EVERYONE@rtncy,D::EVERYONE@:waxTC foo
- modify (in-place) the second ACE above:
$ nfs4setfacl -m D::OWNER@:x D::OWNER@:xo foo
- set ACLs of `bar' and `frobaz' to ACL of `foo':
$ nfs4getfacl foo | nfs4setfacl -S - bar frobaz AUTHORS nfs4setfacl was written by people at CITI, the Center for Information Technology Integration (http://www.citi.umich.edu). This manpage was written by David Richter. CONTACT Please send bug reports, feature requests, and comments to
. SEE ALSO nfs4getfacl(1), nfs4acl(5), RFC3530 (NFSv4.0), NFSv4.1 Minor Version Draft. Linux version 0.3.3, August 2008 NFS4SETFACL(1)