c

chacl(1)

chacl(1)

NAME

chacl - add, modify, delete, copy, or summarize access control lists (ACLs) of ®les

SYNOPSIS

/usr/bin/chacl acl ®le ...

chacl -r acl ®le ...

chacl -daclpatt ®le ...

chacl -ffrom®le to®le ...

chacl - [ z ⏐ Z ⏐ F ] ®le...

DESCRIPTION

chacl extends the capabilities of chmod(1), by enabling the user to grant or restrict ®le access to additional speci®c users and/or groups. Traditional ®le access permissions, set when a ®le is created, grant or restrict access to the ®le's owner, group, and other users. These ®le access permissions (eg., rwxrw-r--) are mapped into three base access control list entries: one entry for the ®le's owner (u.%, mode), one for the ®le's group (%.g, mode), and one for other users (%.%, mode).

chacl enables a user to designate up to thirteen additional sets of permissions (called optional access control list (ACL) entries) which are stored in the access control list of the ®le.

To use chacl, the owner (or superuser) constructs an acl, a set of (user.group, mode) mappings to associate with one or more ®les. A speci®c user and group can be referred to by either name or number; any user (u), group (g), or both can be referred to with a % symbol, representing any user or group. The @ symbol speci®es the ®le's owner or group.

Read, write, and execute/search (rwx) modes are identical to those used by chmod; symbolic operators (op) add (+), remove (-), or set (=) access rights. The entire acl should be quoted if it contains whitespace or special characters. Although two variants for constructing the acl are available (and fully explained in acl(5)), the following syntax is suggested:

entry [, entry ] ...

where the syntax for an entry is

u.g op mode[ op mode ] ...

By default, chacl modi®es existing ACLs. It adds ACL entries or modi®es access rights in existing ACL entries. If acl contains an ACL entry already associated with a ®le, the entry's mode bits are changed to the new value given, or are modi®ed by the speci®ed operators. If the ®le's ACL does not already contain the speci®ed entry, that ACL entry is added. chacl can also remove all access to ®les. Giving it a null acl argument means either ``no access'' (when using the -roption) or ``no changes.''

For a summary of the syntax, run chacl without arguments.

If ®le is speci®ed as -, chacl reads from standard input.

Options

chacl recognizes the following options:

-r

Replace old ACLs with the given ACL. All optional ACL entries are ®rst deleted from the

 

speci®ed ®les's ACLs, their base permissions are set to zero, and the new ACL is applied. If

 

acl does not contain an entry for the owner (u.%), the group (%.g), or other (%.%) users of

 

a ®le, that base ACL entry's mode is set to zero (no access). The command affects all of the

 

®le's ACL entries, but does not change the ®le's owner or group ID.

 

In chmod(1), the ``modify'' and ``replace'' operations are distinguished by the syntax (string

 

or octal value).

There is no corollary for ACLs because they have a variable number of

 

entries. Hence

chacl modi®es speci®c entries by default, and optionally replaces all

 

entries.

 

 

-d

Delete the speci®ed entries from the ACLs on all speci®ed ®les. The aclpatt argument can

 

be an exact ACL or an ACL pattern (see acl(5)).

chacl -dupdates each ®le's ACL only if

 

entries are deleted from it.

 

 

If you attempt to delete a base ACL entry from any ®le, the entry remains but its access

 

mode is set to zero (no access). If you attempt to delete a non-existent ACL entry from a ®le

 

(that is, if an ACL entry pattern matches no ACL entry), chacl informs you of the error,

Section 1−70

 

− 1 −

HP-UX Release 11i: December 2000