Print this page
12288 getfacl and setfacl could stand improvement
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/man/man1/getfacl.1.man.txt
+++ new/usr/src/man/man1/getfacl.1.man.txt
1 1 GETFACL(1) User Commands GETFACL(1)
2 2
3 3
4 4
5 5 NAME
6 6 getfacl - display discretionary file information
7 7
8 8 SYNOPSIS
9 9 getfacl [-ad] file...
|
↓ open down ↓ |
9 lines elided |
↑ open up ↑ |
10 10
11 11
12 12 DESCRIPTION
13 13 For each argument that is a regular file, special file, or named pipe,
14 14 the getfacl utility displays the owner, the group, and the Access
15 15 Control List (ACL). For each directory argument, getfacl displays the
16 16 owner, the group, and the ACL and/or the default ACL. Only directories
17 17 contain default ACLs.
18 18
19 19
20 + The getfacl utility will fail if executed on a file system that
21 + supports NFSv4 ACLs. See acl(5) for a description of the difference
22 + between the older POSIX-draft ACLs and the newer NFSv4 ACLs. The ls(1)
23 + utility, when used with the -v or -V options, will display ACLs on all
24 + types of file system.
25 +
26 +
20 27 The getfacl utility may be executed on a file system that does not
21 28 support ACLs. It reports the ACL based on the base permission bits.
22 29
23 30
24 31 With no options specified, getfacl displays the filename, the file
25 32 owner, the file group owner, and both the ACL and the default ACL, if
26 33 it exists.
27 34
28 35 OPTIONS
29 36 The following options are supported:
30 37
31 38 -a
32 39 Displays the filename, the file owner, the file group owner, and
33 40 the ACL of the file.
34 41
35 42
36 43 -d
37 44 Displays the filename, the file owner, the file group owner, and
38 45 the default ACL of the file, if it exists.
39 46
40 47
41 48 OPERANDS
42 49 The following operands are supported:
43 50
44 51 file
45 52 The path name of a regular file, special file, or named pipe.
46 53
47 54
48 55 OUTPUT
49 56 The format for ACL output is as follows:
50 57
51 58 # file: filename
52 59 # owner: uid
53 60 # group: gid
54 61 user::perm
55 62 user:uid:perm
56 63 group::perm
57 64 group:gid:perm
58 65 mask:perm
59 66 other:perm
60 67 default:user::perm
61 68 default:user:uid:perm
62 69 default:group::perm
63 70 default:group:gid:perm
64 71 default:mask:perm
65 72 default:other:perm
66 73
67 74
68 75
69 76
70 77 When multiple files are specified on the command line, a blank line
71 78 separates the ACLs for each file.
72 79
73 80
74 81 The ACL entries are displayed in the order in which they are evaluated
75 82 when an access check is performed. The default ACL entries that may
76 83 exist on a directory have no effect on access checks.
77 84
78 85
79 86 The first three lines display the filename, the file owner, and the
80 87 file group owner. Notice that when only the -d option is specified and
|
↓ open down ↓ |
51 lines elided |
↑ open up ↑ |
81 88 the file has no default ACL, only these three lines are displayed.
82 89
83 90
84 91 The user entry without a user ID indicates the permissions that are
85 92 granted to the file owner. One or more additional user entries indicate
86 93 the permissions that are granted to the specified users.
87 94
88 95
89 96 The group entry without a group ID indicates the permissions that are
90 97 granted to the file group owner. One or more additional group entries
91 - indicate the permissions that are granted to the specified groups.
98 + indicate the permissions that are granted to the specified groups.
92 99
93 100
94 101 The mask entry indicates the ACL mask permissions. These are the
95 102 maximum permissions allowed to any user entries except the file owner,
96 103 and to any group entries, including the file group owner. These
97 104 permissions restrict the permissions specified in other entries.
98 105
99 106
100 107 The other entry indicates the permissions that are granted to others.
101 108
102 109
103 110 The default entries may exist only for directories. These entries
104 111 indicate the default entries that are added to a file created within
105 112 the directory.
106 113
107 114
|
↓ open down ↓ |
6 lines elided |
↑ open up ↑ |
108 115 The uid is a login name or a user ID if there is no entry for the uid
109 116 in the system password file, /etc/passwd. The gid is a group name or a
110 117 group ID if there is no entry for the gid in the system group file,
111 118 /etc/group. The perm is a three character string composed of the
112 119 letters representing the separate discretionary access rights: r
113 120 (read), w (write), x (execute/search), or the place holder character -.
114 121 The perm is displayed in the following order: rwx. If a permission is
115 122 not granted by an ACL entry, the place holder character appears.
116 123
117 124
118 - If you use the chmod(1) command to change the file group owner
125 + If you use the chmod(1) command to change the file group owner
119 126 permissions on a file with ACL entries, both the file group owner
120 127 permissions and the ACL mask are changed to the new permissions. Be
121 128 aware that the new ACL mask permissions may change the effective
122 129 permissions for additional users and groups who have ACL entries on the
123 130 file.
124 131
125 132
126 - In order to indicate that the ACL mask restricts an ACL entry, getfacl
133 + In order to indicate that the ACL mask restricts an ACL entry, getfacl
127 134 displays an additional tab character, pound sign (#), and the actual
128 135 permissions granted, following the entry.
129 136
130 137 EXAMPLES
131 138 Example 1 Displaying file information
132 139
133 140
134 141 Given file foo, with an ACL six entries long, the command
135 142
136 143
137 144 host% getfacl foo
138 145
139 146
140 147
141 148
142 149 would print:
143 150
144 151
145 152 # file: foo
146 153 # owner: shea
147 154 # group: staff
148 155 user::rwx
149 156 user:spy:---
150 157 user:mookie:r--
151 158 group::r--
152 159 mask::rw-
153 160 other::---
154 161
155 162
156 163
157 164 Example 2 Displaying information after chmod command
158 165
159 166
160 167 Continue with the above example, after chmod 700 foo was issued:
161 168
162 169
163 170 host% getfacl foo
164 171
165 172
166 173
167 174
168 175 would print:
169 176
170 177
171 178 # file: foo
172 179 # owner: shea
173 180 # group: staff
174 181 user::rwx
175 182 user:spy:---
176 183 user:mookie:r-- #effective:---
177 184 group::---
178 185 mask::---
179 186 other::---
180 187
181 188
182 189
183 190 Example 3 Displaying information when ACL contains default entries
184 191
185 192
186 193 Given directory doo, with an ACL containing default entries, the
187 194 command
188 195
189 196
190 197 host% getfacl -d doo
191 198
192 199
193 200
194 201
195 202 would print:
196 203
197 204
198 205 # file: doo
199 206 # owner: shea
200 207 # group: staff
201 208 default:user::rwx
202 209 default:user:spy:---
203 210 default:user:mookie:r--
204 211 default:group::r--
205 212 default:mask::---
206 213 default:other::---
207 214
208 215
209 216
210 217 FILES
211 218 /etc/passwd
212 219 system password file
213 220
214 221
215 222 /etc/group
216 223 group file
217 224
218 225
219 226 ATTRIBUTES
220 227 See attributes(5) for descriptions of the following attributes:
221 228
222 229
|
↓ open down ↓ |
86 lines elided |
↑ open up ↑ |
223 230
224 231
225 232 +--------------------+-----------------+
226 233 | ATTRIBUTE TYPE | ATTRIBUTE VALUE |
227 234 +--------------------+-----------------+
228 235 |Interface Stability | Evolving |
229 236 +--------------------+-----------------+
230 237
231 238 SEE ALSO
232 239 chmod(1), ls(1), setfacl(1), acl(2), aclsort(3SEC), group(4),
233 - passwd(4), attributes(5)
240 + passwd(4), acl(5), attributes(5)
234 241
235 242 NOTES
236 243 The output from getfacl is in the correct format for input to the
237 244 setfacl -f command. If the output from getfacl is redirected to a file,
238 245 the file may be used as input to setfacl. In this way, a user may
239 246 easily assign one file's ACL to another file.
240 247
241 248
242 249
243 - November 5, 1994 GETFACL(1)
250 + February 8, 2020 GETFACL(1)
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX