1b3af24b4SEnji Cooper# Copyright (c) 2008, 2009 Edward Tomasz Napierała <trasz@FreeBSD.org> 2b3af24b4SEnji Cooper# 3b3af24b4SEnji Cooper# Redistribution and use in source and binary forms, with or without 4b3af24b4SEnji Cooper# modification, are permitted provided that the following conditions 5b3af24b4SEnji Cooper# are met: 6b3af24b4SEnji Cooper# 1. Redistributions of source code must retain the above copyright 7b3af24b4SEnji Cooper# notice, this list of conditions and the following disclaimer. 8b3af24b4SEnji Cooper# 2. Redistributions in binary form must reproduce the above copyright 9b3af24b4SEnji Cooper# notice, this list of conditions and the following disclaimer in the 10b3af24b4SEnji Cooper# documentation and/or other materials provided with the distribution. 11b3af24b4SEnji Cooper# 12b3af24b4SEnji Cooper# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 13b3af24b4SEnji Cooper# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 14b3af24b4SEnji Cooper# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 15b3af24b4SEnji Cooper# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 16b3af24b4SEnji Cooper# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 17b3af24b4SEnji Cooper# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 18b3af24b4SEnji Cooper# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 19b3af24b4SEnji Cooper# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 20b3af24b4SEnji Cooper# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 21b3af24b4SEnji Cooper# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 22b3af24b4SEnji Cooper# SUCH DAMAGE. 23b3af24b4SEnji Cooper# 24b3af24b4SEnji Cooper# 25b3af24b4SEnji Cooper 26b3af24b4SEnji Cooper# This is a tools-level test for NFSv4 ACL functionality. Run it as root 27b3af24b4SEnji Cooper# using ACL-enabled kernel: 28b3af24b4SEnji Cooper# 29b3af24b4SEnji Cooper# /usr/src/tools/regression/acltools/run /usr/src/tools/regression/acltools/tools-nfs4.test 30b3af24b4SEnji Cooper# 31b3af24b4SEnji Cooper# WARNING: Creates files in unsafe way. 32b3af24b4SEnji Cooper 33b3af24b4SEnji Cooper$ whoami 34b3af24b4SEnji Cooper> root 35b3af24b4SEnji Cooper$ umask 022 36b3af24b4SEnji Cooper 37b3af24b4SEnji Cooper# Smoke test for getfacl(1). 38b3af24b4SEnji Cooper$ touch xxx 39b3af24b4SEnji Cooper$ getfacl xxx 40b3af24b4SEnji Cooper> # file: xxx 41b3af24b4SEnji Cooper> # owner: root 42b3af24b4SEnji Cooper> # group: wheel 43b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 44b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 45b3af24b4SEnji Cooper> group@:-wxp----------:-------:deny 46b3af24b4SEnji Cooper> group@:r-------------:-------:allow 47b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 48b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 49b3af24b4SEnji Cooper 50b3af24b4SEnji Cooper$ getfacl -q xxx 51b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 52b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 53b3af24b4SEnji Cooper> group@:-wxp----------:-------:deny 54b3af24b4SEnji Cooper> group@:r-------------:-------:allow 55b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 56b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 57b3af24b4SEnji Cooper 58b3af24b4SEnji Cooper# Check verbose mode formatting. 59b3af24b4SEnji Cooper$ getfacl -v xxx 60b3af24b4SEnji Cooper> # file: xxx 61b3af24b4SEnji Cooper> # owner: root 62b3af24b4SEnji Cooper> # group: wheel 63b3af24b4SEnji Cooper> owner@:execute::deny 64b3af24b4SEnji Cooper> owner@:read_data/write_data/append_data/write_attributes/write_xattr/write_acl/write_owner::allow 65b3af24b4SEnji Cooper> group@:write_data/execute/append_data::deny 66b3af24b4SEnji Cooper> group@:read_data::allow 67b3af24b4SEnji Cooper> everyone@:write_data/execute/append_data/write_attributes/write_xattr/write_acl/write_owner::deny 68b3af24b4SEnji Cooper> everyone@:read_data/read_attributes/read_xattr/read_acl/synchronize::allow 69b3af24b4SEnji Cooper 70b3af24b4SEnji Cooper# Test setfacl -a. 71b3af24b4SEnji Cooper$ setfacl -a2 u:0:write_acl:allow,g:1:read_acl:deny xxx 72b3af24b4SEnji Cooper$ getfacl -n xxx 73b3af24b4SEnji Cooper> # file: xxx 74b3af24b4SEnji Cooper> # owner: root 75b3af24b4SEnji Cooper> # group: wheel 76b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 77b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 78b3af24b4SEnji Cooper> user:0:-----------C--:-------:allow 79b3af24b4SEnji Cooper> group:1:----------c---:-------:deny 80b3af24b4SEnji Cooper> group@:-wxp----------:-------:deny 81b3af24b4SEnji Cooper> group@:r-------------:-------:allow 82b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 83b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 84b3af24b4SEnji Cooper 85b3af24b4SEnji Cooper# Test user and group name resolving. 86b3af24b4SEnji Cooper$ rm xxx 87b3af24b4SEnji Cooper$ touch xxx 88b3af24b4SEnji Cooper$ setfacl -a2 u:root:write_acl:allow,g:daemon:read_acl:deny xxx 89b3af24b4SEnji Cooper$ getfacl xxx 90b3af24b4SEnji Cooper> # file: xxx 91b3af24b4SEnji Cooper> # owner: root 92b3af24b4SEnji Cooper> # group: wheel 93b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 94b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 95b3af24b4SEnji Cooper> user:root:-----------C--:-------:allow 96b3af24b4SEnji Cooper> group:daemon:----------c---:-------:deny 97b3af24b4SEnji Cooper> group@:-wxp----------:-------:deny 98b3af24b4SEnji Cooper> group@:r-------------:-------:allow 99b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 100b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 101b3af24b4SEnji Cooper 102b3af24b4SEnji Cooper# Check whether ls correctly marks files with "+". 103b3af24b4SEnji Cooper$ ls -l xxx | cut -d' ' -f1 104b3af24b4SEnji Cooper> -rw-r--r--+ 105b3af24b4SEnji Cooper 106b3af24b4SEnji Cooper# Test removing entries by number. 107b3af24b4SEnji Cooper$ setfacl -x 4 xxx 108b3af24b4SEnji Cooper$ setfacl -x 4 xxx 109b3af24b4SEnji Cooper$ getfacl -n xxx 110b3af24b4SEnji Cooper> # file: xxx 111b3af24b4SEnji Cooper> # owner: root 112b3af24b4SEnji Cooper> # group: wheel 113b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 114b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 115b3af24b4SEnji Cooper> user:0:-----------C--:-------:allow 116b3af24b4SEnji Cooper> group:1:----------c---:-------:deny 117b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 118b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 119b3af24b4SEnji Cooper 120b3af24b4SEnji Cooper# Test setfacl -m. 121b3af24b4SEnji Cooper$ setfacl -a0 everyone@:rwx:deny xxx 122b3af24b4SEnji Cooper$ setfacl -a0 everyone@:rwx:deny xxx 123b3af24b4SEnji Cooper$ setfacl -a0 everyone@:rwx:deny xxx 124b3af24b4SEnji Cooper$ setfacl -m everyone@::deny xxx 125b3af24b4SEnji Cooper$ getfacl -n xxx 126b3af24b4SEnji Cooper> # file: xxx 127b3af24b4SEnji Cooper> # owner: root 128b3af24b4SEnji Cooper> # group: wheel 129b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 130b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 131b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 132b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 133b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 134b3af24b4SEnji Cooper> user:0:-----------C--:-------:allow 135b3af24b4SEnji Cooper> group:1:----------c---:-------:deny 136b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 137b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 138b3af24b4SEnji Cooper 139b3af24b4SEnji Cooper# Test getfacl -i. 140b3af24b4SEnji Cooper$ getfacl -i xxx 141b3af24b4SEnji Cooper> # file: xxx 142b3af24b4SEnji Cooper> # owner: root 143b3af24b4SEnji Cooper> # group: wheel 144b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 145b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 146b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 147b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 148b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 149b3af24b4SEnji Cooper> user:root:-----------C--:-------:allow:0 150b3af24b4SEnji Cooper> group:daemon:----------c---:-------:deny:1 151b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 152b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 153b3af24b4SEnji Cooper 154b3af24b4SEnji Cooper# Make sure cp without any flags does not copy copy the ACL. 155b3af24b4SEnji Cooper$ cp xxx yyy 156b3af24b4SEnji Cooper$ ls -l yyy | cut -d' ' -f1 157b3af24b4SEnji Cooper> -rw-r--r-- 158b3af24b4SEnji Cooper 159b3af24b4SEnji Cooper# Make sure it does with the "-p" flag. 160b3af24b4SEnji Cooper$ rm yyy 161b3af24b4SEnji Cooper$ cp -p xxx yyy 162b3af24b4SEnji Cooper$ getfacl -n yyy 163b3af24b4SEnji Cooper> # file: yyy 164b3af24b4SEnji Cooper> # owner: root 165b3af24b4SEnji Cooper> # group: wheel 166b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 167b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 168b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 169b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 170b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 171b3af24b4SEnji Cooper> user:0:-----------C--:-------:allow 172b3af24b4SEnji Cooper> group:1:----------c---:-------:deny 173b3af24b4SEnji Cooper> everyone@:--------------:-------:deny 174b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 175b3af24b4SEnji Cooper 176b3af24b4SEnji Cooper$ rm yyy 177b3af24b4SEnji Cooper 178b3af24b4SEnji Cooper# Test removing entries by... by example? 179b3af24b4SEnji Cooper$ setfacl -x everyone@::deny xxx 180b3af24b4SEnji Cooper$ getfacl -n xxx 181b3af24b4SEnji Cooper> # file: xxx 182b3af24b4SEnji Cooper> # owner: root 183b3af24b4SEnji Cooper> # group: wheel 184b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 185b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 186b3af24b4SEnji Cooper> user:0:-----------C--:-------:allow 187b3af24b4SEnji Cooper> group:1:----------c---:-------:deny 188b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 189b3af24b4SEnji Cooper 190b3af24b4SEnji Cooper# Test setfacl -b. 191b3af24b4SEnji Cooper$ setfacl -b xxx 192b3af24b4SEnji Cooper$ getfacl -n xxx 193b3af24b4SEnji Cooper> # file: xxx 194b3af24b4SEnji Cooper> # owner: root 195b3af24b4SEnji Cooper> # group: wheel 196b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 197b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 198b3af24b4SEnji Cooper> group@:-wxp----------:-------:deny 199b3af24b4SEnji Cooper> group@:r-------------:-------:allow 200b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 201b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 202b3af24b4SEnji Cooper 203b3af24b4SEnji Cooper$ ls -l xxx | cut -d' ' -f1 204b3af24b4SEnji Cooper> -rw-r--r-- 205b3af24b4SEnji Cooper 206b3af24b4SEnji Cooper# Check setfacl(1) and getfacl(1) with multiple files. 207b3af24b4SEnji Cooper$ touch xxx yyy zzz 208b3af24b4SEnji Cooper 209b3af24b4SEnji Cooper$ ls -l xxx yyy zzz | cut -d' ' -f1 210b3af24b4SEnji Cooper> -rw-r--r-- 211b3af24b4SEnji Cooper> -rw-r--r-- 212b3af24b4SEnji Cooper> -rw-r--r-- 213b3af24b4SEnji Cooper 214b3af24b4SEnji Cooper$ setfacl -m u:42:x:allow,g:43:w:allow nnn xxx yyy zzz 2156951c4eeSMark Johnston> setfacl: nnn: acl_get_file() failed: No such file or directory 216b3af24b4SEnji Cooper 217b3af24b4SEnji Cooper$ ls -l nnn xxx yyy zzz | cut -d' ' -f1 218b3af24b4SEnji Cooper> ls: nnn: No such file or directory 219b3af24b4SEnji Cooper> -rw-r--r--+ 220b3af24b4SEnji Cooper> -rw-r--r--+ 221b3af24b4SEnji Cooper> -rw-r--r--+ 222b3af24b4SEnji Cooper 223b3af24b4SEnji Cooper$ getfacl -nq nnn xxx yyy zzz 224b3af24b4SEnji Cooper> getfacl: nnn: stat() failed: No such file or directory 225b3af24b4SEnji Cooper> user:42:--x-----------:-------:allow 226b3af24b4SEnji Cooper> group:43:-w------------:-------:allow 227b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 228b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 229b3af24b4SEnji Cooper> group@:-wxp----------:-------:deny 230b3af24b4SEnji Cooper> group@:r-------------:-------:allow 231b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 232b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 233b3af24b4SEnji Cooper> 234b3af24b4SEnji Cooper> user:42:--x-----------:-------:allow 235b3af24b4SEnji Cooper> group:43:-w------------:-------:allow 236b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 237b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 238b3af24b4SEnji Cooper> group@:-wxp----------:-------:deny 239b3af24b4SEnji Cooper> group@:r-------------:-------:allow 240b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 241b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 242b3af24b4SEnji Cooper> 243b3af24b4SEnji Cooper> user:42:--x-----------:-------:allow 244b3af24b4SEnji Cooper> group:43:-w------------:-------:allow 245b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 246b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 247b3af24b4SEnji Cooper> group@:-wxp----------:-------:deny 248b3af24b4SEnji Cooper> group@:r-------------:-------:allow 249b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 250b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 251b3af24b4SEnji Cooper 252b3af24b4SEnji Cooper$ setfacl -b nnn xxx yyy zzz 2536951c4eeSMark Johnston> setfacl: nnn: acl_get_file() failed: No such file or directory 254b3af24b4SEnji Cooper 255b3af24b4SEnji Cooper$ ls -l nnn xxx yyy zzz | cut -d' ' -f1 256b3af24b4SEnji Cooper> ls: nnn: No such file or directory 257b3af24b4SEnji Cooper> -rw-r--r-- 258b3af24b4SEnji Cooper> -rw-r--r-- 259b3af24b4SEnji Cooper> -rw-r--r-- 260b3af24b4SEnji Cooper 261b3af24b4SEnji Cooper$ rm xxx yyy zzz 262b3af24b4SEnji Cooper 263b3af24b4SEnji Cooper# Test applying mode to an ACL. 264b3af24b4SEnji Cooper$ touch xxx 265b3af24b4SEnji Cooper$ setfacl -a0 user:42:r:allow,user:43:w:deny,user:43:w:allow,user:44:x:allow -x everyone@::allow xxx 266b3af24b4SEnji Cooper$ chmod 600 xxx 267b3af24b4SEnji Cooper$ getfacl -n xxx 268b3af24b4SEnji Cooper> # file: xxx 269b3af24b4SEnji Cooper> # owner: root 270b3af24b4SEnji Cooper> # group: wheel 271b3af24b4SEnji Cooper> user:42:r-------------:-------:deny 272b3af24b4SEnji Cooper> user:42:r-------------:-------:allow 273b3af24b4SEnji Cooper> user:43:-w------------:-------:deny 274b3af24b4SEnji Cooper> user:43:-w------------:-------:allow 275b3af24b4SEnji Cooper> user:44:--x-----------:-------:deny 276b3af24b4SEnji Cooper> user:44:--x-----------:-------:allow 277b3af24b4SEnji Cooper> owner@:--------------:-------:deny 278b3af24b4SEnji Cooper> owner@:-------A-W-Co-:-------:allow 279b3af24b4SEnji Cooper> group@:--------------:-------:deny 280b3af24b4SEnji Cooper> group@:--------------:-------:allow 281b3af24b4SEnji Cooper> everyone@:-------A-W-Co-:-------:deny 282b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 283b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 284b3af24b4SEnji Cooper> group@:rwxp----------:-------:deny 285b3af24b4SEnji Cooper> group@:--------------:-------:allow 286b3af24b4SEnji Cooper> everyone@:rwxp---A-W-Co-:-------:deny 287b3af24b4SEnji Cooper> everyone@:------a-R-c--s:-------:allow 288b3af24b4SEnji Cooper$ ls -l xxx | cut -d' ' -f1 289b3af24b4SEnji Cooper> -rw-------+ 290b3af24b4SEnji Cooper 291b3af24b4SEnji Cooper$ rm xxx 292b3af24b4SEnji Cooper$ touch xxx 293b3af24b4SEnji Cooper$ chown 42 xxx 294b3af24b4SEnji Cooper$ setfacl -a0 user:42:r:allow,user:43:w:deny,user:43:w:allow,user:44:x:allow xxx 295b3af24b4SEnji Cooper$ chmod 600 xxx 296b3af24b4SEnji Cooper$ getfacl -n xxx 297b3af24b4SEnji Cooper> # file: xxx 298b3af24b4SEnji Cooper> # owner: 42 299b3af24b4SEnji Cooper> # group: wheel 300b3af24b4SEnji Cooper> user:42:--------------:-------:deny 301b3af24b4SEnji Cooper> user:42:r-------------:-------:allow 302b3af24b4SEnji Cooper> user:43:-w------------:-------:deny 303b3af24b4SEnji Cooper> user:43:-w------------:-------:allow 304b3af24b4SEnji Cooper> user:44:--x-----------:-------:deny 305b3af24b4SEnji Cooper> user:44:--x-----------:-------:allow 306b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 307b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 308b3af24b4SEnji Cooper> group@:rwxp----------:-------:deny 309b3af24b4SEnji Cooper> group@:--------------:-------:allow 310b3af24b4SEnji Cooper> everyone@:rwxp---A-W-Co-:-------:deny 311b3af24b4SEnji Cooper> everyone@:------a-R-c--s:-------:allow 312b3af24b4SEnji Cooper$ ls -l xxx | cut -d' ' -f1 313b3af24b4SEnji Cooper> -rw-------+ 314b3af24b4SEnji Cooper 315b3af24b4SEnji Cooper$ rm xxx 316b3af24b4SEnji Cooper$ touch xxx 317b3af24b4SEnji Cooper$ chown 43 xxx 318b3af24b4SEnji Cooper$ setfacl -a0 user:42:r:allow,user:43:w:deny,user:43:w:allow,user:44:x:allow xxx 319b3af24b4SEnji Cooper$ chmod 124 xxx 320b3af24b4SEnji Cooper$ getfacl -n xxx 321b3af24b4SEnji Cooper> # file: xxx 322b3af24b4SEnji Cooper> # owner: 43 323b3af24b4SEnji Cooper> # group: wheel 324b3af24b4SEnji Cooper> user:42:r-------------:-------:deny 325b3af24b4SEnji Cooper> user:42:r-------------:-------:allow 326b3af24b4SEnji Cooper> user:43:-w------------:-------:deny 327b3af24b4SEnji Cooper> user:43:-w------------:-------:allow 328b3af24b4SEnji Cooper> user:44:--x-----------:-------:deny 329b3af24b4SEnji Cooper> user:44:--x-----------:-------:allow 330b3af24b4SEnji Cooper> owner@:rw-p----------:-------:deny 331b3af24b4SEnji Cooper> owner@:--x----A-W-Co-:-------:allow 332b3af24b4SEnji Cooper> group@:r-x-----------:-------:deny 333b3af24b4SEnji Cooper> group@:-w-p----------:-------:allow 334b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 335b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 336b3af24b4SEnji Cooper$ ls -l xxx | cut -d' ' -f1 337b3af24b4SEnji Cooper> ---x-w-r--+ 338b3af24b4SEnji Cooper 339b3af24b4SEnji Cooper$ rm xxx 340b3af24b4SEnji Cooper$ touch xxx 341b3af24b4SEnji Cooper$ chown 43 xxx 342b3af24b4SEnji Cooper$ setfacl -a0 user:42:r:allow,user:43:w:deny,user:43:w:allow,user:44:x:allow xxx 343b3af24b4SEnji Cooper$ chmod 412 xxx 344b3af24b4SEnji Cooper$ getfacl -n xxx 345b3af24b4SEnji Cooper> # file: xxx 346b3af24b4SEnji Cooper> # owner: 43 347b3af24b4SEnji Cooper> # group: wheel 348b3af24b4SEnji Cooper> user:42:r-------------:-------:deny 349b3af24b4SEnji Cooper> user:42:r-------------:-------:allow 350b3af24b4SEnji Cooper> user:43:-w------------:-------:deny 351b3af24b4SEnji Cooper> user:43:-w------------:-------:allow 352b3af24b4SEnji Cooper> user:44:--------------:-------:deny 353b3af24b4SEnji Cooper> user:44:--x-----------:-------:allow 354b3af24b4SEnji Cooper> owner@:-wxp----------:-------:deny 355b3af24b4SEnji Cooper> owner@:r------A-W-Co-:-------:allow 356b3af24b4SEnji Cooper> group@:rw-p----------:-------:deny 357b3af24b4SEnji Cooper> group@:--x-----------:-------:allow 358b3af24b4SEnji Cooper> everyone@:r-x----A-W-Co-:-------:deny 359b3af24b4SEnji Cooper> everyone@:-w-p--a-R-c--s:-------:allow 360b3af24b4SEnji Cooper$ ls -l xxx | cut -d' ' -f1 361b3af24b4SEnji Cooper> -r----x-w-+ 362b3af24b4SEnji Cooper 363b3af24b4SEnji Cooper$ mkdir ddd 364b3af24b4SEnji Cooper$ setfacl -a0 group:44:rwapd:allow ddd 365b3af24b4SEnji Cooper$ setfacl -a0 group:43:write_data/delete_child:d:deny,group@:ad:allow ddd 366b3af24b4SEnji Cooper$ setfacl -a0 user:42:rx:fi:allow,group:42:write_data/delete_child:d:allow ddd 367b3af24b4SEnji Cooper$ setfacl -m everyone@:-w-p--a-R-c--s:fi:allow ddd 368b3af24b4SEnji Cooper$ getfacl -n ddd 369b3af24b4SEnji Cooper> # file: ddd 370b3af24b4SEnji Cooper> # owner: root 371b3af24b4SEnji Cooper> # group: wheel 372b3af24b4SEnji Cooper> user:42:r-x-----------:f-i----:allow 373b3af24b4SEnji Cooper> group:42:-w--D---------:-d-----:allow 374b3af24b4SEnji Cooper> group:43:-w--D---------:-d-----:deny 375b3af24b4SEnji Cooper> group@:-----da-------:-------:allow 376b3af24b4SEnji Cooper> group:44:rw-p-da-------:-------:allow 377b3af24b4SEnji Cooper> owner@:--------------:-------:deny 378b3af24b4SEnji Cooper> owner@:rwxp---A-W-Co-:-------:allow 379b3af24b4SEnji Cooper> group@:-w-p----------:-------:deny 380b3af24b4SEnji Cooper> group@:r-x-----------:-------:allow 381b3af24b4SEnji Cooper> everyone@:-w-p---A-W-Co-:-------:deny 382b3af24b4SEnji Cooper> everyone@:-w-p--a-R-c--s:f-i----:allow 383b3af24b4SEnji Cooper$ chmod 777 ddd 384b3af24b4SEnji Cooper$ getfacl -n ddd 385b3af24b4SEnji Cooper> # file: ddd 386b3af24b4SEnji Cooper> # owner: root 387b3af24b4SEnji Cooper> # group: wheel 388b3af24b4SEnji Cooper> user:42:r-x-----------:f-i----:allow 389b3af24b4SEnji Cooper> group:42:-w--D---------:-di----:allow 390b3af24b4SEnji Cooper> group:42:--------------:-------:deny 391b3af24b4SEnji Cooper> group:42:-w--D---------:-------:allow 392b3af24b4SEnji Cooper> group:43:-w--D---------:-di----:deny 393b3af24b4SEnji Cooper> group:43:-w--D---------:-------:deny 394b3af24b4SEnji Cooper> group@:-----da-------:-------:allow 395b3af24b4SEnji Cooper> group:44:--------------:-------:deny 396b3af24b4SEnji Cooper> group:44:rw-p-da-------:-------:allow 397b3af24b4SEnji Cooper> owner@:--------------:-------:deny 398b3af24b4SEnji Cooper> owner@:-------A-W-Co-:-------:allow 399b3af24b4SEnji Cooper> group@:--------------:-------:deny 400b3af24b4SEnji Cooper> group@:--------------:-------:allow 401b3af24b4SEnji Cooper> everyone@:-------A-W-Co-:-------:deny 402b3af24b4SEnji Cooper> everyone@:-w-p--a-R-c--s:f-i----:allow 403b3af24b4SEnji Cooper> owner@:--------------:-------:deny 404b3af24b4SEnji Cooper> owner@:rwxp---A-W-Co-:-------:allow 405b3af24b4SEnji Cooper> group@:--------------:-------:deny 406b3af24b4SEnji Cooper> group@:rwxp----------:-------:allow 407b3af24b4SEnji Cooper> everyone@:-------A-W-Co-:-------:deny 408b3af24b4SEnji Cooper> everyone@:rwxp--a-R-c--s:-------:allow 409b3af24b4SEnji Cooper 410b3af24b4SEnji Cooper$ rmdir ddd 411b3af24b4SEnji Cooper$ mkdir ddd 412b3af24b4SEnji Cooper$ setfacl -a0 group:44:rwapd:allow ddd 413b3af24b4SEnji Cooper$ setfacl -a0 group:43:write_data/delete_child:d:deny,group@:ad:allow ddd 414b3af24b4SEnji Cooper$ setfacl -a0 user:42:rx:fi:allow,group:42:write_data/delete_child:d:allow ddd 415b3af24b4SEnji Cooper$ setfacl -m everyone@:-w-p--a-R-c--s:fi:allow ddd 416b3af24b4SEnji Cooper$ chmod 124 ddd 417b3af24b4SEnji Cooper$ getfacl -n ddd 418b3af24b4SEnji Cooper> # file: ddd 419b3af24b4SEnji Cooper> # owner: root 420b3af24b4SEnji Cooper> # group: wheel 421b3af24b4SEnji Cooper> user:42:r-x-----------:f-i----:allow 422b3af24b4SEnji Cooper> group:42:-w--D---------:-di----:allow 423b3af24b4SEnji Cooper> group:42:--------------:-------:deny 424b3af24b4SEnji Cooper> group:42:----D---------:-------:allow 425b3af24b4SEnji Cooper> group:43:-w--D---------:-di----:deny 426b3af24b4SEnji Cooper> group:43:-w--D---------:-------:deny 427b3af24b4SEnji Cooper> group@:-----da-------:-------:allow 428b3af24b4SEnji Cooper> group:44:r-------------:-------:deny 429b3af24b4SEnji Cooper> group:44:r----da-------:-------:allow 430b3af24b4SEnji Cooper> owner@:--------------:-------:deny 431b3af24b4SEnji Cooper> owner@:-------A-W-Co-:-------:allow 432b3af24b4SEnji Cooper> group@:--------------:-------:deny 433b3af24b4SEnji Cooper> group@:--------------:-------:allow 434b3af24b4SEnji Cooper> everyone@:-------A-W-Co-:-------:deny 435b3af24b4SEnji Cooper> everyone@:-w-p--a-R-c--s:f-i----:allow 436b3af24b4SEnji Cooper> owner@:rw-p----------:-------:deny 437b3af24b4SEnji Cooper> owner@:--x----A-W-Co-:-------:allow 438b3af24b4SEnji Cooper> group@:r-x-----------:-------:deny 439b3af24b4SEnji Cooper> group@:-w-p----------:-------:allow 440b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 441b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 442b3af24b4SEnji Cooper 443b3af24b4SEnji Cooper$ rmdir ddd 444b3af24b4SEnji Cooper$ mkdir ddd 445b3af24b4SEnji Cooper$ setfacl -a0 group:44:rwapd:allow ddd 446b3af24b4SEnji Cooper$ setfacl -a0 group:43:write_data/delete_child:d:deny,group@:ad:allow ddd 447b3af24b4SEnji Cooper$ setfacl -a0 user:42:rx:allow,user:42:rx:fi:allow,group:42:write_data/delete_child:d:allow ddd 448b3af24b4SEnji Cooper$ setfacl -m everyone@:-w-p--a-R-c--s:fi:allow ddd 449b3af24b4SEnji Cooper$ chmod 412 ddd 450b3af24b4SEnji Cooper$ getfacl -n ddd 451b3af24b4SEnji Cooper> # file: ddd 452b3af24b4SEnji Cooper> # owner: root 453b3af24b4SEnji Cooper> # group: wheel 454b3af24b4SEnji Cooper> user:42:r-------------:-------:deny 455b3af24b4SEnji Cooper> user:42:r-x-----------:-------:allow 456b3af24b4SEnji Cooper> user:42:r-x-----------:f-i----:allow 457b3af24b4SEnji Cooper> group:42:-w--D---------:-di----:allow 458b3af24b4SEnji Cooper> group:42:-w------------:-------:deny 459b3af24b4SEnji Cooper> group:42:-w--D---------:-------:allow 460b3af24b4SEnji Cooper> group:43:-w--D---------:-di----:deny 461b3af24b4SEnji Cooper> group:43:-w--D---------:-------:deny 462b3af24b4SEnji Cooper> group@:-----da-------:-------:allow 463b3af24b4SEnji Cooper> group:44:rw-p----------:-------:deny 464b3af24b4SEnji Cooper> group:44:rw-p-da-------:-------:allow 465b3af24b4SEnji Cooper> owner@:--------------:-------:deny 466b3af24b4SEnji Cooper> owner@:-------A-W-Co-:-------:allow 467b3af24b4SEnji Cooper> group@:--------------:-------:deny 468b3af24b4SEnji Cooper> group@:--------------:-------:allow 469b3af24b4SEnji Cooper> everyone@:-------A-W-Co-:-------:deny 470b3af24b4SEnji Cooper> everyone@:-w-p--a-R-c--s:f-i----:allow 471b3af24b4SEnji Cooper> owner@:-wxp----------:-------:deny 472b3af24b4SEnji Cooper> owner@:r------A-W-Co-:-------:allow 473b3af24b4SEnji Cooper> group@:rw-p----------:-------:deny 474b3af24b4SEnji Cooper> group@:--x-----------:-------:allow 475b3af24b4SEnji Cooper> everyone@:r-x----A-W-Co-:-------:deny 476b3af24b4SEnji Cooper> everyone@:-w-p--a-R-c--s:-------:allow 477b3af24b4SEnji Cooper 478b3af24b4SEnji Cooper$ rmdir ddd 479b3af24b4SEnji Cooper$ mkdir ddd 480b3af24b4SEnji Cooper$ setfacl -a0 group:44:rwapd:allow ddd 481b3af24b4SEnji Cooper$ setfacl -a0 group:43:write_data/delete_child:d:deny,group@:ad:allow ddd 482b3af24b4SEnji Cooper$ setfacl -a0 user:42:rx:allow,user:42:rx:fi:allow,group:42:write_data/delete_child:d:allow ddd 483b3af24b4SEnji Cooper$ setfacl -m everyone@:-w-p--a-R-c--s:fi:allow ddd 484b3af24b4SEnji Cooper$ chown 42 ddd 485b3af24b4SEnji Cooper$ chmod 412 ddd 486b3af24b4SEnji Cooper$ getfacl -n ddd 487b3af24b4SEnji Cooper> # file: ddd 488b3af24b4SEnji Cooper> # owner: 42 489b3af24b4SEnji Cooper> # group: wheel 490b3af24b4SEnji Cooper> user:42:--x-----------:-------:deny 491b3af24b4SEnji Cooper> user:42:r-x-----------:-------:allow 492b3af24b4SEnji Cooper> user:42:r-x-----------:f-i----:allow 493b3af24b4SEnji Cooper> group:42:-w--D---------:-di----:allow 494b3af24b4SEnji Cooper> group:42:-w------------:-------:deny 495b3af24b4SEnji Cooper> group:42:-w--D---------:-------:allow 496b3af24b4SEnji Cooper> group:43:-w--D---------:-di----:deny 497b3af24b4SEnji Cooper> group:43:-w--D---------:-------:deny 498b3af24b4SEnji Cooper> group@:-----da-------:-------:allow 499b3af24b4SEnji Cooper> group:44:rw-p----------:-------:deny 500b3af24b4SEnji Cooper> group:44:rw-p-da-------:-------:allow 501b3af24b4SEnji Cooper> owner@:--------------:-------:deny 502b3af24b4SEnji Cooper> owner@:-------A-W-Co-:-------:allow 503b3af24b4SEnji Cooper> group@:--------------:-------:deny 504b3af24b4SEnji Cooper> group@:--------------:-------:allow 505b3af24b4SEnji Cooper> everyone@:-------A-W-Co-:-------:deny 506b3af24b4SEnji Cooper> everyone@:-w-p--a-R-c--s:f-i----:allow 507b3af24b4SEnji Cooper> owner@:-wxp----------:-------:deny 508b3af24b4SEnji Cooper> owner@:r------A-W-Co-:-------:allow 509b3af24b4SEnji Cooper> group@:rw-p----------:-------:deny 510b3af24b4SEnji Cooper> group@:--x-----------:-------:allow 511b3af24b4SEnji Cooper> everyone@:r-x----A-W-Co-:-------:deny 512b3af24b4SEnji Cooper> everyone@:-w-p--a-R-c--s:-------:allow 513b3af24b4SEnji Cooper 514b3af24b4SEnji Cooper# Test applying ACL to mode. 515b3af24b4SEnji Cooper$ rmdir ddd 516b3af24b4SEnji Cooper$ mkdir ddd 517b3af24b4SEnji Cooper$ setfacl -a0 u:42:rwx:fi:allow ddd 518b3af24b4SEnji Cooper$ ls -ld ddd | cut -d' ' -f1 519b3af24b4SEnji Cooper> drwxr-xr-x+ 520b3af24b4SEnji Cooper 521b3af24b4SEnji Cooper$ rmdir ddd 522b3af24b4SEnji Cooper$ mkdir ddd 523b3af24b4SEnji Cooper$ chmod 0 ddd 524b3af24b4SEnji Cooper$ setfacl -a0 owner@:r:allow,group@:w:deny,group@:wx:allow ddd 525b3af24b4SEnji Cooper$ ls -ld ddd | cut -d' ' -f1 526b3af24b4SEnji Cooper> dr----x---+ 527b3af24b4SEnji Cooper 528b3af24b4SEnji Cooper$ rmdir ddd 529b3af24b4SEnji Cooper$ mkdir ddd 530b3af24b4SEnji Cooper$ chmod 0 ddd 531b3af24b4SEnji Cooper$ setfacl -a0 owner@:r:allow,group@:w:fi:deny,group@:wx:allow ddd 532b3af24b4SEnji Cooper$ ls -ld ddd | cut -d' ' -f1 533b3af24b4SEnji Cooper> dr---wx---+ 534b3af24b4SEnji Cooper 535b3af24b4SEnji Cooper$ rmdir ddd 536b3af24b4SEnji Cooper$ mkdir ddd 537b3af24b4SEnji Cooper$ chmod 0 ddd 538b3af24b4SEnji Cooper$ setfacl -a0 owner@:r:allow,group:43:w:deny,group:43:wx:allow ddd 539b3af24b4SEnji Cooper$ ls -ld ddd | cut -d' ' -f1 540b3af24b4SEnji Cooper> dr--------+ 541b3af24b4SEnji Cooper 542b3af24b4SEnji Cooper$ rmdir ddd 543b3af24b4SEnji Cooper$ mkdir ddd 544b3af24b4SEnji Cooper$ chmod 0 ddd 545b3af24b4SEnji Cooper$ setfacl -a0 owner@:r:allow,user:43:w:deny,user:43:wx:allow ddd 546b3af24b4SEnji Cooper$ ls -ld ddd | cut -d' ' -f1 547b3af24b4SEnji Cooper> dr--------+ 548b3af24b4SEnji Cooper 549b3af24b4SEnji Cooper# Test inheritance. 550b3af24b4SEnji Cooper$ rmdir ddd 551b3af24b4SEnji Cooper$ mkdir ddd 552b3af24b4SEnji Cooper$ setfacl -a0 group:43:write_data/write_acl:fin:deny,u:43:rwxp:allow ddd 553b3af24b4SEnji Cooper$ setfacl -a0 user:42:rx:fi:allow,group:42:write_data/delete_child:dn:deny ddd 554b3af24b4SEnji Cooper$ setfacl -a0 user:42:write_acl/write_owner:fi:allow ddd 555b3af24b4SEnji Cooper$ setfacl -a0 group:41:read_data/read_attributes:dni:allow ddd 556b3af24b4SEnji Cooper$ setfacl -a0 user:41:write_data/write_attributes:fn:allow ddd 557b3af24b4SEnji Cooper$ getfacl -qn ddd 558b3af24b4SEnji Cooper> user:41:-w-----A------:f--n---:allow 559b3af24b4SEnji Cooper> group:41:r-----a-------:-din---:allow 560b3af24b4SEnji Cooper> user:42:-----------Co-:f-i----:allow 561b3af24b4SEnji Cooper> user:42:r-x-----------:f-i----:allow 562b3af24b4SEnji Cooper> group:42:-w--D---------:-d-n---:deny 563b3af24b4SEnji Cooper> group:43:-w---------C--:f-in---:deny 564b3af24b4SEnji Cooper> user:43:rwxp----------:-------:allow 565b3af24b4SEnji Cooper> owner@:--------------:-------:deny 566b3af24b4SEnji Cooper> owner@:rwxp---A-W-Co-:-------:allow 567b3af24b4SEnji Cooper> group@:-w-p----------:-------:deny 568b3af24b4SEnji Cooper> group@:r-x-----------:-------:allow 569b3af24b4SEnji Cooper> everyone@:-w-p---A-W-Co-:-------:deny 570b3af24b4SEnji Cooper> everyone@:r-x---a-R-c--s:-------:allow 571b3af24b4SEnji Cooper 572b3af24b4SEnji Cooper$ cd ddd 573b3af24b4SEnji Cooper$ touch xxx 574b3af24b4SEnji Cooper$ getfacl -qn xxx 575b3af24b4SEnji Cooper> user:41:-w------------:-------:deny 576b3af24b4SEnji Cooper> user:41:-w-----A------:-------:allow 577b3af24b4SEnji Cooper> user:42:--------------:-------:deny 578b3af24b4SEnji Cooper> user:42:--------------:-------:allow 579b3af24b4SEnji Cooper> user:42:--x-----------:-------:deny 580b3af24b4SEnji Cooper> user:42:r-x-----------:-------:allow 581b3af24b4SEnji Cooper> group:43:-w---------C--:-------:deny 582b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 583b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 584b3af24b4SEnji Cooper> group@:-wxp----------:-------:deny 585b3af24b4SEnji Cooper> group@:r-------------:-------:allow 586b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 587b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 588b3af24b4SEnji Cooper 589b3af24b4SEnji Cooper$ rm xxx 590b3af24b4SEnji Cooper$ umask 077 591b3af24b4SEnji Cooper$ touch xxx 592b3af24b4SEnji Cooper$ getfacl -qn xxx 593b3af24b4SEnji Cooper> user:41:-w------------:-------:deny 594b3af24b4SEnji Cooper> user:41:-w-----A------:-------:allow 595b3af24b4SEnji Cooper> user:42:--------------:-------:deny 596b3af24b4SEnji Cooper> user:42:--------------:-------:allow 597b3af24b4SEnji Cooper> user:42:r-x-----------:-------:deny 598b3af24b4SEnji Cooper> user:42:r-x-----------:-------:allow 599b3af24b4SEnji Cooper> group:43:-w---------C--:-------:deny 600b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 601b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 602b3af24b4SEnji Cooper> group@:rwxp----------:-------:deny 603b3af24b4SEnji Cooper> group@:--------------:-------:allow 604b3af24b4SEnji Cooper> everyone@:rwxp---A-W-Co-:-------:deny 605b3af24b4SEnji Cooper> everyone@:------a-R-c--s:-------:allow 606b3af24b4SEnji Cooper 607b3af24b4SEnji Cooper$ rm xxx 608b3af24b4SEnji Cooper$ umask 770 609b3af24b4SEnji Cooper$ touch xxx 610b3af24b4SEnji Cooper$ getfacl -qn xxx 611b3af24b4SEnji Cooper> user:41:-w------------:-------:deny 612b3af24b4SEnji Cooper> user:41:-w-----A------:-------:allow 613b3af24b4SEnji Cooper> user:42:--------------:-------:deny 614b3af24b4SEnji Cooper> user:42:--------------:-------:allow 615b3af24b4SEnji Cooper> user:42:r-x-----------:-------:deny 616b3af24b4SEnji Cooper> user:42:r-x-----------:-------:allow 617b3af24b4SEnji Cooper> group:43:-w---------C--:-------:deny 618b3af24b4SEnji Cooper> owner@:rwxp----------:-------:deny 619b3af24b4SEnji Cooper> owner@:-------A-W-Co-:-------:allow 620b3af24b4SEnji Cooper> group@:rwxp----------:-------:deny 621b3af24b4SEnji Cooper> group@:--------------:-------:allow 622b3af24b4SEnji Cooper> everyone@:--x----A-W-Co-:-------:deny 623b3af24b4SEnji Cooper> everyone@:rw-p--a-R-c--s:-------:allow 624b3af24b4SEnji Cooper 625b3af24b4SEnji Cooper$ rm xxx 626b3af24b4SEnji Cooper$ umask 707 627b3af24b4SEnji Cooper$ touch xxx 628b3af24b4SEnji Cooper$ getfacl -qn xxx 629b3af24b4SEnji Cooper> user:41:--------------:-------:deny 630b3af24b4SEnji Cooper> user:41:-w-----A------:-------:allow 631b3af24b4SEnji Cooper> user:42:--------------:-------:deny 632b3af24b4SEnji Cooper> user:42:--------------:-------:allow 633b3af24b4SEnji Cooper> user:42:--x-----------:-------:deny 634b3af24b4SEnji Cooper> user:42:r-x-----------:-------:allow 635b3af24b4SEnji Cooper> group:43:-w---------C--:-------:deny 636b3af24b4SEnji Cooper> owner@:rwxp----------:-------:deny 637b3af24b4SEnji Cooper> owner@:-------A-W-Co-:-------:allow 638b3af24b4SEnji Cooper> group@:--x-----------:-------:deny 639b3af24b4SEnji Cooper> group@:rw-p----------:-------:allow 640b3af24b4SEnji Cooper> everyone@:rwxp---A-W-Co-:-------:deny 641b3af24b4SEnji Cooper> everyone@:------a-R-c--s:-------:allow 642b3af24b4SEnji Cooper 643b3af24b4SEnji Cooper$ umask 077 644b3af24b4SEnji Cooper$ mkdir yyy 645b3af24b4SEnji Cooper$ getfacl -qn yyy 646b3af24b4SEnji Cooper> group:41:r-------------:-------:deny 647b3af24b4SEnji Cooper> group:41:r-----a-------:-------:allow 648b3af24b4SEnji Cooper> user:42:-----------Co-:f-i----:allow 649b3af24b4SEnji Cooper> user:42:r-x-----------:f-i----:allow 650b3af24b4SEnji Cooper> group:42:-w--D---------:-------:deny 651b3af24b4SEnji Cooper> owner@:--------------:-------:deny 652b3af24b4SEnji Cooper> owner@:rwxp---A-W-Co-:-------:allow 653b3af24b4SEnji Cooper> group@:rwxp----------:-------:deny 654b3af24b4SEnji Cooper> group@:--------------:-------:allow 655b3af24b4SEnji Cooper> everyone@:rwxp---A-W-Co-:-------:deny 656b3af24b4SEnji Cooper> everyone@:------a-R-c--s:-------:allow 657b3af24b4SEnji Cooper 658b3af24b4SEnji Cooper$ rmdir yyy 659b3af24b4SEnji Cooper$ umask 770 660b3af24b4SEnji Cooper$ mkdir yyy 661b3af24b4SEnji Cooper$ getfacl -qn yyy 662b3af24b4SEnji Cooper> group:41:r-------------:-------:deny 663b3af24b4SEnji Cooper> group:41:r-----a-------:-------:allow 664b3af24b4SEnji Cooper> user:42:-----------Co-:f-i----:allow 665b3af24b4SEnji Cooper> user:42:r-x-----------:f-i----:allow 666b3af24b4SEnji Cooper> group:42:-w--D---------:-------:deny 667b3af24b4SEnji Cooper> owner@:rwxp----------:-------:deny 668b3af24b4SEnji Cooper> owner@:-------A-W-Co-:-------:allow 669b3af24b4SEnji Cooper> group@:rwxp----------:-------:deny 670b3af24b4SEnji Cooper> group@:--------------:-------:allow 671b3af24b4SEnji Cooper> everyone@:-------A-W-Co-:-------:deny 672b3af24b4SEnji Cooper> everyone@:rwxp--a-R-c--s:-------:allow 673b3af24b4SEnji Cooper 674b3af24b4SEnji Cooper$ rmdir yyy 675b3af24b4SEnji Cooper$ umask 707 676b3af24b4SEnji Cooper$ mkdir yyy 677b3af24b4SEnji Cooper$ getfacl -qn yyy 678b3af24b4SEnji Cooper> group:41:--------------:-------:deny 679b3af24b4SEnji Cooper> group:41:------a-------:-------:allow 680b3af24b4SEnji Cooper> user:42:-----------Co-:f-i----:allow 681b3af24b4SEnji Cooper> user:42:r-x-----------:f-i----:allow 682b3af24b4SEnji Cooper> group:42:-w--D---------:-------:deny 683b3af24b4SEnji Cooper> owner@:rwxp----------:-------:deny 684b3af24b4SEnji Cooper> owner@:-------A-W-Co-:-------:allow 685b3af24b4SEnji Cooper> group@:--------------:-------:deny 686b3af24b4SEnji Cooper> group@:rwxp----------:-------:allow 687b3af24b4SEnji Cooper> everyone@:rwxp---A-W-Co-:-------:deny 688b3af24b4SEnji Cooper> everyone@:------a-R-c--s:-------:allow 689b3af24b4SEnji Cooper 690b3af24b4SEnji Cooper# There is some complication regarding how write_acl and write_owner flags 691b3af24b4SEnji Cooper# get inherited. Make sure we got it right. 692b3af24b4SEnji Cooper$ setfacl -b . 693b3af24b4SEnji Cooper$ setfacl -a0 u:42:Co:f:allow . 694b3af24b4SEnji Cooper$ setfacl -a0 u:43:Co:d:allow . 695b3af24b4SEnji Cooper$ setfacl -a0 u:44:Co:fd:allow . 696b3af24b4SEnji Cooper$ setfacl -a0 u:45:Co:fi:allow . 697b3af24b4SEnji Cooper$ setfacl -a0 u:46:Co:di:allow . 698b3af24b4SEnji Cooper$ setfacl -a0 u:47:Co:fdi:allow . 699b3af24b4SEnji Cooper$ setfacl -a0 u:48:Co:fn:allow . 700b3af24b4SEnji Cooper$ setfacl -a0 u:49:Co:dn:allow . 701b3af24b4SEnji Cooper$ setfacl -a0 u:50:Co:fdn:allow . 702b3af24b4SEnji Cooper$ setfacl -a0 u:51:Co:fni:allow . 703b3af24b4SEnji Cooper$ setfacl -a0 u:52:Co:dni:allow . 704b3af24b4SEnji Cooper$ setfacl -a0 u:53:Co:fdni:allow . 705b3af24b4SEnji Cooper$ umask 022 706b3af24b4SEnji Cooper$ rm xxx 707b3af24b4SEnji Cooper$ touch xxx 708b3af24b4SEnji Cooper$ getfacl -nq xxx 709b3af24b4SEnji Cooper> user:53:--------------:-------:deny 710b3af24b4SEnji Cooper> user:53:--------------:-------:allow 711b3af24b4SEnji Cooper> user:51:--------------:-------:deny 712b3af24b4SEnji Cooper> user:51:--------------:-------:allow 713b3af24b4SEnji Cooper> user:50:--------------:-------:deny 714b3af24b4SEnji Cooper> user:50:--------------:-------:allow 715b3af24b4SEnji Cooper> user:48:--------------:-------:deny 716b3af24b4SEnji Cooper> user:48:--------------:-------:allow 717b3af24b4SEnji Cooper> user:47:--------------:-------:deny 718b3af24b4SEnji Cooper> user:47:--------------:-------:allow 719b3af24b4SEnji Cooper> user:45:--------------:-------:deny 720b3af24b4SEnji Cooper> user:45:--------------:-------:allow 721b3af24b4SEnji Cooper> user:44:--------------:-------:deny 722b3af24b4SEnji Cooper> user:44:--------------:-------:allow 723b3af24b4SEnji Cooper> user:42:--------------:-------:deny 724b3af24b4SEnji Cooper> user:42:--------------:-------:allow 725b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 726b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 727b3af24b4SEnji Cooper> group@:-wxp----------:-------:deny 728b3af24b4SEnji Cooper> group@:r-------------:-------:allow 729b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 730b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 731b3af24b4SEnji Cooper 732b3af24b4SEnji Cooper$ rmdir yyy 733b3af24b4SEnji Cooper$ mkdir yyy 734b3af24b4SEnji Cooper$ getfacl -nq yyy 735b3af24b4SEnji Cooper> user:53:--------------:-------:deny 736b3af24b4SEnji Cooper> user:53:--------------:-------:allow 737b3af24b4SEnji Cooper> user:52:--------------:-------:deny 738b3af24b4SEnji Cooper> user:52:--------------:-------:allow 739b3af24b4SEnji Cooper> user:50:--------------:-------:deny 740b3af24b4SEnji Cooper> user:50:--------------:-------:allow 741b3af24b4SEnji Cooper> user:49:--------------:-------:deny 742b3af24b4SEnji Cooper> user:49:--------------:-------:allow 743b3af24b4SEnji Cooper> user:47:-----------Co-:fdi----:allow 744b3af24b4SEnji Cooper> user:47:--------------:-------:deny 745b3af24b4SEnji Cooper> user:47:--------------:-------:allow 746b3af24b4SEnji Cooper> user:46:-----------Co-:-di----:allow 747b3af24b4SEnji Cooper> user:46:--------------:-------:deny 748b3af24b4SEnji Cooper> user:46:--------------:-------:allow 749b3af24b4SEnji Cooper> user:45:-----------Co-:f-i----:allow 750b3af24b4SEnji Cooper> user:44:-----------Co-:fdi----:allow 751b3af24b4SEnji Cooper> user:44:--------------:-------:deny 752b3af24b4SEnji Cooper> user:44:--------------:-------:allow 753b3af24b4SEnji Cooper> user:43:-----------Co-:-di----:allow 754b3af24b4SEnji Cooper> user:43:--------------:-------:deny 755b3af24b4SEnji Cooper> user:43:--------------:-------:allow 756b3af24b4SEnji Cooper> user:42:-----------Co-:f-i----:allow 757b3af24b4SEnji Cooper> owner@:--------------:-------:deny 758b3af24b4SEnji Cooper> owner@:rwxp---A-W-Co-:-------:allow 759b3af24b4SEnji Cooper> group@:-w-p----------:-------:deny 760b3af24b4SEnji Cooper> group@:r-x-----------:-------:allow 761b3af24b4SEnji Cooper> everyone@:-w-p---A-W-Co-:-------:deny 762b3af24b4SEnji Cooper> everyone@:r-x---a-R-c--s:-------:allow 763b3af24b4SEnji Cooper 764b3af24b4SEnji Cooper$ setfacl -b . 765b3af24b4SEnji Cooper$ setfacl -a0 u:42:Co:f:deny . 766b3af24b4SEnji Cooper$ setfacl -a0 u:43:Co:d:deny . 767b3af24b4SEnji Cooper$ setfacl -a0 u:44:Co:fd:deny . 768b3af24b4SEnji Cooper$ setfacl -a0 u:45:Co:fi:deny . 769b3af24b4SEnji Cooper$ setfacl -a0 u:46:Co:di:deny . 770b3af24b4SEnji Cooper$ setfacl -a0 u:47:Co:fdi:deny . 771b3af24b4SEnji Cooper$ setfacl -a0 u:48:Co:fn:deny . 772b3af24b4SEnji Cooper$ setfacl -a0 u:49:Co:dn:deny . 773b3af24b4SEnji Cooper$ setfacl -a0 u:50:Co:fdn:deny . 774b3af24b4SEnji Cooper$ setfacl -a0 u:51:Co:fni:deny . 775b3af24b4SEnji Cooper$ setfacl -a0 u:52:Co:dni:deny . 776b3af24b4SEnji Cooper$ setfacl -a0 u:53:Co:fdni:deny . 777b3af24b4SEnji Cooper$ umask 022 778b3af24b4SEnji Cooper$ rm xxx 779b3af24b4SEnji Cooper$ touch xxx 780b3af24b4SEnji Cooper$ getfacl -nq xxx 781b3af24b4SEnji Cooper> user:53:-----------Co-:-------:deny 782b3af24b4SEnji Cooper> user:51:-----------Co-:-------:deny 783b3af24b4SEnji Cooper> user:50:-----------Co-:-------:deny 784b3af24b4SEnji Cooper> user:48:-----------Co-:-------:deny 785b3af24b4SEnji Cooper> user:47:-----------Co-:-------:deny 786b3af24b4SEnji Cooper> user:45:-----------Co-:-------:deny 787b3af24b4SEnji Cooper> user:44:-----------Co-:-------:deny 788b3af24b4SEnji Cooper> user:42:-----------Co-:-------:deny 789b3af24b4SEnji Cooper> owner@:--x-----------:-------:deny 790b3af24b4SEnji Cooper> owner@:rw-p---A-W-Co-:-------:allow 791b3af24b4SEnji Cooper> group@:-wxp----------:-------:deny 792b3af24b4SEnji Cooper> group@:r-------------:-------:allow 793b3af24b4SEnji Cooper> everyone@:-wxp---A-W-Co-:-------:deny 794b3af24b4SEnji Cooper> everyone@:r-----a-R-c--s:-------:allow 795b3af24b4SEnji Cooper 796b3af24b4SEnji Cooper$ rmdir yyy 797b3af24b4SEnji Cooper$ mkdir yyy 798b3af24b4SEnji Cooper$ getfacl -nq yyy 799b3af24b4SEnji Cooper> user:53:-----------Co-:-------:deny 800b3af24b4SEnji Cooper> user:52:-----------Co-:-------:deny 801b3af24b4SEnji Cooper> user:50:-----------Co-:-------:deny 802b3af24b4SEnji Cooper> user:49:-----------Co-:-------:deny 803b3af24b4SEnji Cooper> user:47:-----------Co-:fdi----:deny 804b3af24b4SEnji Cooper> user:47:-----------Co-:-------:deny 805b3af24b4SEnji Cooper> user:46:-----------Co-:-di----:deny 806b3af24b4SEnji Cooper> user:46:-----------Co-:-------:deny 807b3af24b4SEnji Cooper> user:45:-----------Co-:f-i----:deny 808b3af24b4SEnji Cooper> user:44:-----------Co-:fdi----:deny 809b3af24b4SEnji Cooper> user:44:-----------Co-:-------:deny 810b3af24b4SEnji Cooper> user:43:-----------Co-:-di----:deny 811b3af24b4SEnji Cooper> user:43:-----------Co-:-------:deny 812b3af24b4SEnji Cooper> user:42:-----------Co-:f-i----:deny 813b3af24b4SEnji Cooper> owner@:--------------:-------:deny 814b3af24b4SEnji Cooper> owner@:rwxp---A-W-Co-:-------:allow 815b3af24b4SEnji Cooper> group@:-w-p----------:-------:deny 816b3af24b4SEnji Cooper> group@:r-x-----------:-------:allow 817b3af24b4SEnji Cooper> everyone@:-w-p---A-W-Co-:-------:deny 818b3af24b4SEnji Cooper> everyone@:r-x---a-R-c--s:-------:allow 819b3af24b4SEnji Cooper 820b3af24b4SEnji Cooper$ rmdir yyy 821b3af24b4SEnji Cooper$ rm xxx 822b3af24b4SEnji Cooper$ cd .. 823b3af24b4SEnji Cooper$ rmdir ddd 824b3af24b4SEnji Cooper$ rm xxx 825b3af24b4SEnji Cooper 826*36847545SMark Johnston# Test basic recursive setting of ACLs. 827*36847545SMark Johnston$ mkdir ddd 828*36847545SMark Johnston$ touch ddd/xxx 829*36847545SMark Johnston$ mkdir ddd/eee 830*36847545SMark Johnston$ touch ddd/eee/yyy 831*36847545SMark Johnston$ setfacl -R -m owner@:full_set:f:allow,group@:full_set::allow,everyone@:full_set::allow ddd 832*36847545SMark Johnston$ getfacl -q ddd 833*36847545SMark Johnston> owner@:--------------:-------:deny 834*36847545SMark Johnston> owner@:rwxpDdaARWcCos:f------:allow 835*36847545SMark Johnston> group@:-w-p----------:-------:deny 836*36847545SMark Johnston> group@:rwxpDdaARWcCos:-------:allow 837*36847545SMark Johnston> everyone@:-w-p---A-W-Co-:-------:deny 838*36847545SMark Johnston> everyone@:rwxpDdaARWcCos:-------:allow 839*36847545SMark Johnston$ getfacl -q ddd/xxx 840*36847545SMark Johnston> owner@:--x-----------:-------:deny 841*36847545SMark Johnston> owner@:rwxpDdaARWcCos:-------:allow 842*36847545SMark Johnston> group@:-wxp----------:-------:deny 843*36847545SMark Johnston> group@:rwxpDdaARWcCos:-------:allow 844*36847545SMark Johnston> everyone@:-wxp---A-W-Co-:-------:deny 845*36847545SMark Johnston> everyone@:rwxpDdaARWcCos:-------:allow 846*36847545SMark Johnston$ getfacl -q ddd/eee 847*36847545SMark Johnston> owner@:--------------:-------:deny 848*36847545SMark Johnston> owner@:rwxpDdaARWcCos:f------:allow 849*36847545SMark Johnston> group@:-w-p----------:-------:deny 850*36847545SMark Johnston> group@:rwxpDdaARWcCos:-------:allow 851*36847545SMark Johnston> everyone@:-w-p---A-W-Co-:-------:deny 852*36847545SMark Johnston> everyone@:rwxpDdaARWcCos:-------:allow 853*36847545SMark Johnston$ getfacl -q ddd/eee/yyy 854*36847545SMark Johnston> owner@:--x-----------:-------:deny 855*36847545SMark Johnston> owner@:rwxpDdaARWcCos:-------:allow 856*36847545SMark Johnston> group@:-wxp----------:-------:deny 857*36847545SMark Johnston> group@:rwxpDdaARWcCos:-------:allow 858*36847545SMark Johnston> everyone@:-wxp---A-W-Co-:-------:deny 859*36847545SMark Johnston> everyone@:rwxpDdaARWcCos:-------:allow 860*36847545SMark Johnston 861*36847545SMark Johnston$ rm -r ddd 862