ACL Property Modes (Solaris ZFS Administration Guide)

Solaris ZFS Administration Guide

ACL Property Modes

The ZFS file system includes two property modes related to ACLs:

aclinherit – This property determines the behavior of ACL inheritance. Values include the following:
- discard – For new objects, no ACL entries are inherited when a file or directory is created. The ACL on the file or directory is equal to the permission mode of the file or directory.
- noallow – For new objects, only inheritable ACL entries that have an access type of deny are inherited.
- restricted – For new objects, the write_owner and write_acl permissions are removed when an ACL entry is inherited.
- passthrough – When property value is set to passthrough, files are created with a mode determined by the inheritable ACEs. If no inheritable ACEs exist that affect the mode, then the mode is set in accordance to the requested mode from the application.
- passthrough-x – Has the same semantics as passthrough, except that when passthrough-x is enabled, files are created with the execute (x) permission, but only if execute permission is set in the file creation mode and in an inheritable ACE that affects the mode.
The default mode for the aclinherit is restricted.
aclmode – This property modifies ACL behavior when a file is initially created or whenever a file or directory's mode is modified by the chmod command. Values include the following:
- discard – All ACL entries are removed except for the entries needed to define the mode of the file or directory.
- groupmask – User or group ACL permissions are reduced so that they are no greater than the group permission bits, unless it is a user entry that has the same UID as the owner of the file or directory. Then, the ACL permissions are reduced so that they are no greater than owner permission bits.
- passthrough – During a chmod operation, ACEs other than owner@, group@, or everyone@ are not modified in any way. ACEs with owner@, group@, or everyone@ are disabled to set the file mode as requested by the chmod operation.
The default mode for the aclmode property is groupmask.