3

I'm trying to use setfacl to set the permissions of different ZFS datasets, and I want those ACL permissions equivalent to UNIX-style chmod 770.

What setfacl command could accomplish this, and what ACLs should getfacl display if I were to do this correctly?

I'm running FreeNAS 11.0 with Samba 4.6.4.

user260467
  • 275
  • 2
  • 13
  • It wouldn't surprise me to find out that it's not possible to do the equivalent of `chmod 770` with ACLs, since the solution already exists: `chmod 770`. – Andrew Henle Dec 16 '17 at 13:15

1 Answers1

1

Note: the following is from a Solaris system, but the results should also work on BSD (where you need to use getfacl/setfacl instead of ls/chmod).

The default permissions of a newly created (text) file are:

   owner@:rw-p--aARWcCos:-------:allow
   group@:r-----a-R-c--s:-------:allow
everyone@:r-----a-R-c--s:-------:allow

If you use chmod 0770 /path/to/file, you will get:

   owner@:rwxp--aARWcCos:-------:allow
   group@:rwxp--a-R-c--s:-------:allow
everyone@:------a-R-c--s:-------:allow

Essentially, execute (x) is added for owner and group, read (r) is removed from everyone, and write (w) and append (p) are added to group.

For a directory, it looks as follows:

   owner@:rwxp-DaARWcCos:-------:allow
   group@:r-x---a-R-c--s:-------:allow
everyone@:r-x---a-R-c--s:-------:allow

And after modification:

   owner@:rwxp-DaARWcCos:-------:allow
   group@:rwxp-Da-R-c--s:-------:allow
everyone@:------a-R-c--s:-------:allow

Here, read (r) and execute (x) are removed from everyone, while owner and group have the same permissions as in the file case, although with added delete_child (D) permission (this comes from being a directory).

user121391
  • 2,452
  • 12
  • 31
  • So, on FreeNAS, the existence of ACLs on files and directories seems to completely invalidate the `chmod` command. So my question is about what flags to use in `setfacl`, because `chmod` doesn't work to modify ACLs in this way. So, thank you for laying out what the ACLs should be, but I still don't understand what flags should be included in `setfacl` to set them as such. I'm just finding the `setfacl` `man` page really inaccessible. – user260467 Dec 19 '17 at 17:16