1.\"- 2.\" Copyright (c) 2001 Chris D. Faulhaber 3.\" All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 1. Redistributions of source code must retain the above copyright 9.\" notice, this list of conditions and the following disclaimer. 10.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 14.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR THE VOICES IN HIS HEAD BE 18.\" LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 19.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 20.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 21.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 22.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 23.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 24.\" POSSIBILITY OF SUCH DAMAGE. 25.\" 26.\" $FreeBSD$ 27.\" 28.Dd January 7, 2001 29.Dt SETFACL 1 30.Os 31.Sh NAME 32.Nm setfacl 33.Nd set ACL information 34.Sh SYNOPSIS 35.Nm 36.Op Fl bdhkn 37.Op Fl m Ar entries 38.Op Fl M Ar file 39.Op Fl x Ar entries 40.Op Fl X Ar file 41.Op Ar 42.Sh DESCRIPTION 43The 44.Nm 45utility sets discretionary access control information on 46the specified file(s). 47If no files are specified, or the list consists of the 48only "-", the file names are taken from the standard input. 49.Pp 50The following options are available: 51.Bl -tag -width indent 52.It Fl b 53Remove all ACL entries except for the three required entries. 54If the ACL contains a 55.Dq Li mask 56entry, the permissions of the 57.Dq Li group 58entry in the resulting ACL will be set to the permission 59associated with both the 60.Dq Li group 61and 62.Dq Li mask 63entries of the current ACL. 64.It Fl d 65The operations apply to the default ACL entries instead of 66access ACL entries. 67Currently only directories may have 68default ACL's. 69.It Fl h 70If the target of the operation is a symbolic link, perform the operation 71on the symbolic link itself, rather than following the link. 72.It Fl k 73Delete any default ACL entries on the specified files. 74It 75is not considered an error if the specified files do not have 76any default ACL entries. 77An error will be reported if any of 78the specified files cannot have a default entry (i.e.\& 79non-directories). 80.It Fl m Ar entries 81Modify the ACL entries on the specified files by adding new 82entries and modifying existing ACL entries with the ACL entries 83specified in 84.Ar entries . 85.It Fl M Ar file 86Modify the ACL entries on the specified files by adding new 87ACL entries and modifying existing ACL entries with the ACL 88entries specified in the file 89.Ar file . 90If 91.Ar file 92is 93.Fl , 94the input is taken from stdin. 95.It Fl n 96Do not recalculate the permissions associated with the ACL 97mask entry. 98.It Fl x Ar entries 99Remove the ACL entries specified in 100.Ar entries 101from the access or default ACL of the specified files. 102.It Fl X Ar file 103Remove the ACL entries specified in the file 104.Ar file 105from the access or default ACL of the specified files. 106.El 107.Pp 108The above options are evaluated in the order specified 109on the command-line. 110.Sh ACL ENTRIES 111An ACL entry contains three colon-separated fields: 112an ACL tag, an ACL qualifier, and discretionary access 113permissions: 114.Bl -tag -width indent 115.It Ar "ACL tag" 116The ACL tag specifies the ACL entry type and consists of 117one of the following: 118.Dq Li user 119or 120.Ql u 121specifying the access 122granted to the owner of the file or a specified user; 123.Dq Li group 124or 125.Ql g 126specifying the access granted to the file owning group 127or a specified group; 128.Dq Li other 129or 130.Ql o 131specifying the access 132granted to any process that does not match any user or group 133ACL entry; 134.Dq Li mask 135or 136.Ql m 137specifying the maximum access 138granted to any ACL entry except the 139.Dq Li user 140ACL entry for the file owner and the 141.Dq Li other 142ACL entry. 143.It Ar "ACL qualifier" 144The ACL qualifier field describes the user or group associated with 145the ACL entry. 146It may consist of one of the following: uid or 147user name, gid or group name, or empty. 148For 149.Dq Li user 150ACL entries, an empty field specifies access granted to the 151file owner. 152For 153.Dq Li group 154ACL entries, an empty field specifies access granted to the 155file owning group. 156.Dq Li mask 157and 158.Dq Li other 159ACL entries do not use this field. 160.It Ar "access permissions" 161The access permissions field contains up to one of each of 162the following: 163.Ql r , 164.Ql w , 165and 166.Ql x 167to set read, write, and 168execute permissions, respectively. 169Each of these may be excluded 170or replaced with a 171.Ql - 172character to indicate no access. 173.El 174.Pp 175A 176.Dq Li mask 177ACL entry is required on a file with any ACL entries other than 178the default 179.Dq Li user , 180.Dq Li group , 181and 182.Dq Li other 183ACL entries. 184If the 185.Fl n 186option is not specified and no 187.Dq Li mask 188ACL entry was specified, the 189.Nm 190utility 191will apply a 192.Dq Li mask 193ACL entry consisting of the union of the permissions associated 194with all 195.Dq Li group 196ACL entries in the resulting ACL. 197.Pp 198Traditional POSIX interfaces acting on file system object modes have 199modified semantics in the presence of POSIX.1e extended ACLs. 200When a mask entry is present on the access ACL of an object, the mask 201entry is substituted for the group bits; this occurs in programs such 202as 203.Xr stat 1 204or 205.Xr ls 1 . 206When the mode is modified on an object that has a mask entry, the 207changes applied to the group bits will actually be applied to the 208mask entry. 209These semantics provide for greater application compatibility: 210applications modifying the mode instead of the ACL will see 211conservative behavior, limiting the effective rights granted by all 212of the additional user and group entries; this occurs in programs 213such as 214.Xr chmod 1 . 215.Pp 216ACL entries applied from a file using the 217.Fl M 218or 219.Fl X 220options shall be of the following form: one ACL entry per line, as 221previously specified; whitespace is ignored; any text after a 222.Ql # 223is ignored (comments). 224.Pp 225When ACL entries are evaluated, the access check algorithm checks 226the ACL entries in the following order: file owner, 227.Dq Li user 228ACL entries, file owning group, 229.Dq Li group 230ACL entries, and 231.Dq Li other 232ACL entry. 233.Pp 234Multiple ACL entries specified on the command line are 235separated by commas. 236.Sh EXIT STATUS 237.Ex -std 238.Sh EXAMPLES 239.Dl setfacl -m u::rwx,g:mail:rw file 240.Pp 241Sets read, write, and execute permissions for the 242.Pa file 243owner's ACL entry and read and write permissions for group mail on 244.Pa file . 245.Pp 246.Dl setfacl -M file1 file2 247.Pp 248Sets/updates the ACL entries contained in 249.Pa file1 250on 251.Pa file2 . 252.Pp 253.Dl setfacl -x g:mail:rw file 254.Pp 255Remove the group mail ACL entry containing read/write permissions 256from 257.Pa file . 258.Pp 259.Dl setfacl -bn file 260.Pp 261Remove all 262.Dq Li access 263ACL entries except for the three required from 264.Pa file . 265.Pp 266.Dl getfacl file1 | setfacl -b -n -M - file2 267.Pp 268Copy ACL entries from 269.Pa file1 270to 271.Pa file2 . 272.Sh SEE ALSO 273.Xr getfacl 1 , 274.Xr acl 3 , 275.Xr getextattr 8 , 276.Xr setextattr 8 , 277.Xr acl 9 , 278.Xr extattr 9 279.Sh STANDARDS 280The 281.Nm 282utility is expected to be 283.Tn IEEE 284Std 1003.2c compliant. 285.Sh HISTORY 286Extended Attribute and Access Control List support was developed 287as part of the 288.Tn TrustedBSD 289Project and introduced in 290.Fx 5.0 . 291.Sh AUTHORS 292The 293.Nm 294utility was written by 295.An Chris D. Faulhaber Aq jedgar@fxp.org . 296