fs setacl                  AFS Commands               fs setacl


NAME

   fs setacl -- sets access control list for a directory.


                              +                           +
   fs setacl  -dir <directory>  -acl <access list entries> 
   [-clear]
   [-negative]  [-help]

ACCEPTABLE ABBREVIATIONS/ALIASES

                       +                         +
   fs sa -d <directory>  -a <access list entries>  [-c] [-n]
   [-h]

DESCRIPTION

   Puts the specified access list entries on the access control
   list (ACL) of each specified directory.

WARNING

   If the ACL already grants certain rights to a user or group,
   the  rights specified with access list entries replace them,
   rather than just being added to them.

   Setting negative rights is  generally  unnecessary  and  not
   recommended.    Simply  omitting  a  user  or group from the
   Normal rights list is normally adequate to  prevent  access.
   In  particular,  note  that it is futile to deny rights that
   are granted to system:anyuser on the same ACL; all the  user
   needs to do is issue the unlog command to receive the denied
   rights.

ARGUMENTS

   -dir            specifies  each  directory  for  which   the
                   access    control   list   is   to   change.
                   Abbreviated   pathnames   are    interpreted
                   relative  to  the  directory  in  which  the
                   command is issued.

   -acl            defines a list of one or more entries,  each
                   of which specifies

                      - a user name or group name (letters
                        all lowercase)

                      - the   access   right(s)   to    be
                        associated with the user/group

                   in  that  order, separated by a space.  This
                   argument is unusual in requiring  two  parts
                   for    each    instance.      The   accepted
                   abbreviation of each right and  the  meaning
                   of the right follows:

                   r    READ.  Allows the possessor to read the
                        contents of files in the directory  and
                        to  "stat"  (issue  ls -l for) file and



                        subdirectory elements in the directory.

                   w    WRITE.   Allows the possessor to modify
                        the contents of files in the  directory
                        and to change their UNIX mode bits with
                        chmod.

                   l    LOOKUP.  Allows the possessor  to  list
                        the  names  of files and subdirectories
                        in  the  directory  (for  example,   by
                        issuing  ls).  The possessor may "stat"
                        (issue ls -l for) the directory  itself
                        (but  not  for files and subdirectories
                        in it) and may examine the  directory's
                        ACL.

                   d    DELETE.  Allows the possessor to remove
                        files from the directory.

                   i    INSERT.  Allows the possessor to create
                        new  files  in  the  directory  or move
                        existing files into it.

                   k    LOCK.   Allows  the  possessor  to  run
                        programs that need to issue the "flock"
                        system call on files in the  directory.

                   a    ADMINISTER.    Allows  the possessor to
                        change the directory's ACL.

                   A, B, C, D, E, F, G, H;  by  default,  these
                        have   no   meaning   to   AFS   server
                        processes.        Administrators    and
                        application    programs    may   assign
                        meanings to them and place them on ACLs
                        to  control  access  to the directory's
                        contents in new ways.  The letters must
                        be uppercase.

                   all  all seven standard rights (rlidwka).

                   none no rights.  Removes the user/group from
                        the ACL, but  may  not  guarantee  they
                        have no rights if they belong to groups
                        that remain on the ACL.

                   read both r and l.

                   write
                        all  rights except ADMINISTER (rlidwk).

                   It is legal to mix  the  individual  letters
                   and  the  words  within access list entries,
                   but not  within  an  individual  pairing  of
                   user/group and rights.

   -clear          removes  all existing entries on each access
                   control  list  before  placing  access  list
                   entries  on  it.    This should be used with
                   caution:  if access list  entries  does  not
                   grant   all  rights  to  the  owner  of  the



                   directory, it can  become  awkward  for  the
                   owner  to access items in the directory.  In
                   particular,  not  having  the  LOOKUP  right
                   makes it impossible to resolve the "dot" ( .
                   ) and "dot dot"  (  .  .  )  shorthand  from
                   within the directory.

   -negative       puts  the  specified  access list entries in
                   the Negative rights section of  each  access
                   control   list.    The  user/group  is  thus
                   explicitly denied the indicated rights, even
                   if entries on the accompanying Normal rights
                   section of the  access  control  list  grant
                   them  rights.    However,  it is possible to
                   unlog   to   obtain   rights   granted    to
                   system:anyuser  on the Normal rights section
                   of the same ACL; see the WARNING above.

                   This flag affects all directories and access
                   list  entries  specified.    Its  use is not
                   recommended; see the WARNING section  above.
                   If  the  issuer  omits this flag, the access
                   list  entries  go  into  the   Normal rights
                   section of the access control list.

   -help           prints   the  online  help  entry  for  this
                   command.  Do not provide any other arguments
                   or  flags with this one.  See section 3.1 in
                   the Reference Manual for more details.

EXAMPLES

   The following example adds two entries to the  Normal rights
   part of the current working directory's ACL: the first entry
   grants READ and LOOKUP  rights  to  pat:friends,  while  the
   other  (using  the  write shorthand) gives all rights except
   ADMINISTER to smith.

   % fs sa . pat:friends rl smith write

   The following shows the effect of the -clear flag on the ACL
   of  the  subdirectory  reports by showing the ACL before and
   after the command is issued:

   % fs la reports  Access list for reports is  Normal rights:
   system:authuser rl     pat:friends rlid     smith rlidwk
   pat rlidwka  Negative rights:     terry rl

   % fs sa -clear reports pat all smith write system:anyuser rl
   % fs la reports  Access list for reports is  Normal rights:
   system:anyuser rl     smith rlidwk     pat rlidwka



   The following shows how  the  -dir  and  -acl  switches  are
   necessary  when  more  than one directory is specified.  The
   new entry  granting  READ,  LOOKUP,  and  INSERT  rights  to
   pat:friends  is  added  to  the  ACL  for  both  the current
   directory and its public subdirectory.

   % fs sa -d . public -a pat:friends rli

PRIVILEGE REQUIRED

   Issuer must have ADMINISTER rights  to  the  directory;  the
   directory's   owner  and  members  of  system:administrators
   always do.

MORE INFORMATION

   fs copyacl

   fs listacl
