Ubuntu Manpage: nfs4_setfacl, nfs4_editfacl - manipulate NFSv4 file/directory access control lists

Provided by: nfs4-acl-tools_0.4.2-1_amd64

NAME

       nfs4_setfacl, nfs4_editfacl - manipulate NFSv4 file/directory access control lists

SYNOPSIS

       nfs4_setfacl [OPTIONS] COMMAND file...
       nfs4_editfacl [OPTIONS] file...

DESCRIPTION

nfs4_setfacl manipulates the NFSv4 Access Control List (ACL) of one or more files (or directories),
provided they are on a mounted NFSv4 filesystem which supports ACLs.

nfs4_editfacl is equivalent to nfs4_setfacl -e.

Refer to the nfs4_acl(5) manpage for information about NFSv4 ACL terminology and syntax.

COMMANDS
-a acl_spec
add the ACEs from acl_spec to file's ACL. ACEs are inserted starting at the default position 1 of
file's ACL.

-A acl_file
add the ACEs from the acl_spec in acl_file to file's ACL. ACEs are inserted starting at the
default position 1 of file's ACL.

-x acl_spec
delete ACEs matched from acl_spec from file's ACL. Note that the ordering of the ACEs in acl_spec
does not matter.

-X acl_file
delete ACEs matched from the acl_spec in acl_file from file's ACL. Note that the ordering of the
ACEs in the acl_spec does not matter.

-i index
ACEs are inserted or deleted starting at the indexth position (DEFAULT: 1) of file's ACL. It can
be used only with the add or delete action.

-s acl_spec
set file's ACL to acl_spec.

-S acl_file
set file's ACL to the acl_spec in acl_file.

-e, --edit
edit file's ACL in the editor defined in the EDITOR environment variable (DEFAULT: vi(1)) and set
the resulting ACL upon a clean exit, assuming changes made in the editor were saved. Note that if
multiple files are specified, the editor will be serially invoked once per file.

-m from_ace to_ace
modify file's ACL in-place by replacing from_ace with to_ace.

-?, -h, --help
display help text and exit.

--version
display this program's version and exit.

NOTE: if '-' is given as the acl_file with the -A/-X/-S flags, the acl_spec will be read from stdin.

OPTIONS
-R, --recursive
recursively apply to a directory's files and subdirectories. Similar to setfacl(1), the default
behavior is to follow symlinks given on the command line and to skip symlinks encountered while
recursing through directories.

-L, --logical
in conjunction with -R/--recursive, a logical walk follows all symbolic links.

-P, --physical
in conjunction with -R/--recursive, a physical walk skips all symbolic links.

--dacl
acts on the dacl only. This functionality is only available if the server supports NFSv4 minor
version 1 or newer.

--sacl
acts on the sacl only. This functionality is only available if the server supports NFSv4 minor
version 1 or newer.

--test
display results of COMMAND, but do not save changes.

PERMISSIONS ALIASES

       With nfs4_setfacl, one can use simple abbreviations ("aliases") to express generic  "read"  (R),  generic
       "write"  (W),  and  generic  "execute"  (X) permissions, familiar from the POSIX mode bits used by, e.g.,
       chmod(1).  To use these aliases, one can  put  them  in  the  permissions  field  of  an  NFSv4  ACE  and
       nfs4_setfacl  will  convert them: an R is expanded to rntcy, a W is expanded to watTNcCy (with D added to
       directory ACEs), and an X is expanded to xtcy.  Please refer to the nfs4_acl(5) manpage  for  information
       on specific NFSv4 ACE permissions.

       For  example,  if  one wanted to grant generic "read" and "write" access on a file, the NFSv4 permissions
       field would normally contain something like rwatTnNcCy.  Instead, one might use aliases to accomplish the
       same goal with RW.

       The two permissions not included in any of the aliases are d (delete) and o (write-owner).  However, they
       can still be used: e.g., a permissions field consisting of Wdo expresses generic "write" access  as  well
       as the ability to delete and change ownership.

EXAMPLES

       Assume that the file `foo' has the following NFSv4 ACL for the following examples:

              A::OWNER@:rwatTnNcCy
              D::OWNER@:x
              A:g:GROUP@:rtncy
              D:g:GROUP@:waxTC
              A::EVERYONE@:rtncy
              D::EVERYONE@:waxTC

       - add  ACE granting `alice@nfsdomain.org' generic "read" and "execute" access (defaults to prepending ACE
         to ACL):
              $ nfs4_setfacl -a A::alice@nfsdomain.org:rxtncy foo

       - add the same ACE as above, but using aliases:
              $ nfs4_setfacl -a A::alice@nfsdomain.org:RX foo

       - add the same ACE as above, at index 2:
              $ nfs4_setfacl -i 2 -a A::alice@nfsdomain.org:RX foo

       - edit existing ACL in a text editor and set modified ACL on clean save/exit:
              $ nfs4_setfacl -e foo

       - set ACL (overwrites original) to contents of a spec_file named `newacl.txt':
              $ nfs4_setfacl -S newacl.txt foo

       - recursively set the ACLs of all files  and  subdirectories  in  the  current  directory,  skipping  all
         symlinks encountered, to the ACL contained in the spec_file named `newacl.txt':
              $ nfs4_setfacl -R -P -S newacl.txt *

       - delete the first ACE, but only print the resulting ACL (does not save changes):
              $ nfs4_setfacl --test -x 1 foo

       - delete the last two ACEs above:
              $ nfs4_setfacl -x A::EVERYONE@rtncy,D::EVERYONE@:waxTC foo

       - modify (in-place) the second ACE above:
              $ nfs4_setfacl -m D::OWNER@:x  D::OWNER@:xo foo

       - set ACLs of `bar' and `frobaz' to ACL of `foo':
              $ nfs4_getfacl foo | nfs4_setfacl -S - bar frobaz

AUTHORS

       nfs4_setfacl  was  written  by  people  at  CITI,  the  Center  for  Information  Technology  Integration
       (http://www.citi.umich.edu).  This manpage was written by David Richter.

CONTACT

       Please send bug reports, feature requests, and comments to <linux-nfs@vger.kernel.org>.