You can set and display permissions on ZFS files in a compact format that uses 14 unique letters to represent the permissions. The letters that represent the compact permissions are listed in Table 8–2 and Table 8–3.
You can display compact ACL listings for files and directories by using the ls -V command. For example:
# ls -V file.1 -rw-r--r-- 1 root root 206674 Jul 29 10:27 file.1 owner@:--x-----------:-------:deny owner@:rw-p---A-W-Co-:-------:allow group@:-wxp----------:-------:deny group@:r-------------:-------:allow everyone@:-wxp---A-W-Co-:-------:deny everyone@:r-----a-R-c--s:-------:allow |
The compact ACL output is described as follows:
The owner is denied execute permissions to the file (x=execute).
The owner can read and modify the contents of the file (rw=read_data/write_data), (p=append_data). The owner can also modify the file's attributes such as timestamps, extended attributes, and ACLs (A=write_xattr, W=write_attributes, C=write_acl). In addition, the owner can modify the ownership of the file (o=write_owner).
The group is denied modify and execute permissions to the file (write_data, p=append_data, and x=execute).
The group is granted read permissions to the file (r=read_data).
Everyone who is not user or group is denied permission to execute or modify the contents of the file, and to modify any attributes of the file (w=write_data, x=execute, p=append_data, A=write_xattr, W=write_attributes, C=write_acl, and o=write_owner).
Everyone who is not user or group is granted read permissions to the file and the file's attributes (r=read_data, a=append_data, R=read_xattr, c=read_acl, and s=synchronize). The synchronize access permission is not currently implemented.
Compact ACL format provides the following advantages over verbose ACL format:
Permissions can be specified as positional arguments to the chmod command.
The hyphen (-) characters, which identify no permissions, can be removed and only the required letters need to be specified.
Both permissions and inheritance flags are set in the same fashion.
For information about using the verbose ACL format, see Setting and Displaying ACLs on ZFS Files in Verbose Format.
In the following example, a trivial ACL exists on file.1:
# ls -V file.1 -rw-r--r-- 1 root root 206674 Jul 29 10:27 file.1 owner@:--x-----------:-------:deny owner@:rw-p---A-W-Co-:-------:allow group@:-wxp----------:-------:deny group@:r-------------:-------:allow everyone@:-wxp---A-W-Co-:-------:deny everyone@:r-----a-R-c--s:-------:allow |
In this example, read_data/execute permissions are added for the user gozer on file.1.
# chmod A+user:gozer:rx:allow file.1 # ls -V file.1 -rw-r--r--+ 1 root root 206674 Jul 29 10:27 file.1 user:gozer:r-x-----------:-------:allow owner@:--x-----------:-------:deny owner@:rw-p---A-W-Co-:-------:allow group@:-wxp----------:-------:deny group@:r-------------:-------:allow everyone@:-wxp---A-W-Co-:-------:deny everyone@:r-----a-R-c--s:-------:allow |
Another way to add the same permissions for user gozer is to insert a new ACL at a specific position, 4, for example. As such, the existing ACLs at positions 4–6 are pushed down. For example:
# chmod A4+user:gozer:rx:allow file.1 # ls -V file.1 -rw-r--r--+ 1 root root 206674 Jul 29 10:27 file.1 user:gozer:r-x-----------:-------:allow owner@:--x-----------:-------:deny owner@:rw-p---A-W-Co-:-------:allow group@:-wxp----------:-------:deny user:gozer:r-x-----------:-------:allow group@:r-------------:-------:allow everyone@:-wxp---A-W-Co-:-------:deny everyone@:r-----a-R-c--s:-------:allow |
In the following example, user gozer is granted read, write, and execute permissions that are inherited for newly created files and directories by using the compact ACL format.
# chmod A+user:gozer:rwx:fd:allow dir.2 # ls -dV dir.2 drwxr-xr-x+ 2 root root 2 Jul 29 10:44 dir.2 user:gozer:rwx-----------:fd-----:allow owner@:--------------:-------:deny owner@:rwxp---A-W-Co-:-------:allow group@:-w-p----------:-------:deny group@:r-x-----------:-------:allow everyone@:-w-p---A-W-Co-:-------:deny everyone@:r-x---a-R-c--s:-------:allow |
You can also cut and paste permissions and inheritance flags from the ls -V output into the compact chmod format. For example, to duplicate the permissions and inheritance flags on dir.2 for user gozer to user cindys on dir.2, copy and paste the permission and inheritance flags (rwx-----------:f------:allow) into your chmod command. For example:
# chmod A+user:cindys:rwx-----------:fd----:allow dir.2 # ls -dV dir.2 drwxr-xr-x+ 2 root root 2 Jul 29 10:44 dir.2 user:cindys:rwx-----------:fd-----:allow user:gozer:rwx-----------:fd-----:allow owner@:--------------:-------:deny owner@:rwxp---A-W-Co-:-------:allow group@:-w-p----------:-------:deny group@:r-x-----------:-------:allow everyone@:-w-p---A-W-Co-:-------:deny everyone@:r-x---a-R-c--s:-------:allow |
A file system that has the aclinherit property set to passthrough inherits all inheritable ACL entries without any modifications made to the ACL entries when they are inherited. When this property is set to passthrough, files are created with a permission mode that is determined by the inheritable ACEs. If no inheritable ACEs exist that affect the permission mode, then the permission mode is set in accordance to the requested mode from the application.
The following examples use compact ACL syntax to show how to inherit permission bits by setting aclinherit mode to passthrough.
In this example, an ACL is set on test1.dir to force inheritance. The syntax creates an owner@, group@, and everyone@ ACL entry for newly created files. Newly created directories inherit an @owner, group@, and everyone@ ACL entry. Additionally, directories inherit 6 other ACEs that propagate the ACEs to newly created directories and files.
# zfs set aclinherit=passthrough tank/cindys # pwd /tank/cindys # mkdir test1.dir |
# chmod A=owner@:rwxpcCosRrWaAdD:fd:allow,group@:rwxp:fd:allow,everyone@::fd:allow test1.dir # ls -Vd test1.dir drwxrwx---+ 2 root root 2 Jun 20 15:26 test1.dir owner@:rwxpdDaARWcCos:fd-----:allow group@:rwxp----------:fd-----:allow everyone@:--------------:fd-----:allow |
In this example, a newly created file inherits the ACL that was specified to be inherited to newly created files.
# cd test1.dir # touch file.1 # ls -V file.1 -rwxrwx---+ 1 root root 0 Jun 23 09:38 file.1 owner@:rwxpdDaARWcCos:------I:allow group@:rwxp----------:------I:allow everyone@:--------------:------I:allow |
In this example, a newly created directory inherits both ACEs that control access to this directory as well as ACEs for future propagation to children of the newly created directory.
# mkdir subdir.1 # ls -dV subdir.1 drwxrwx---+ 2 root root 2 Jun 23 09:41 subdir.1 owner@:rwxpdDaARWcCos:fdi---I:allow owner@:rwxpdDaARWcCos:------I:allow group@:rwxp----------:fdi---I:allow group@:rwxp----------:------I:allow everyone@:--------------:fdi---I:allow everyone@:--------------:------I:allow |
The -di-- and f-i--- entries are for propagating inheritance and are not considered during access control. In this example, a file is created with a trivial ACL in another directory where inherited ACEs are not present.
# cd /tank/cindys # mkdir test2.dir # cd test2.dir # touch file.2 # ls -V file.2 -rw-r--r-- 1 root root 0 Jun 23 09:50 file.2 owner@:--x-----------:------:deny owner@:rw-p---A-W-Co-:------:allow group@:-wxp----------:------:deny group@:r-------------:------:allow everyone@:-wxp---A-W-Co-:------:deny everyone@:r-----a-R-c--s:------:allow |
When aclinherit=passthrough-x is enabled, files are created with the execute (x) permission for owner@, group@, or everyone@, but only if execute permission is set in the file creation mode and in an inheritable ACE that affects the mode.
The following example shows how to inherit the execute permission by setting aclinherit mode to passthrough-x.
# zfs set aclinherit=passthrough-x tank/cindys |
The following ACL is set on /tank/cindys/test1.dir to provide executable ACL inheritance for files for owner@,
# chmod A=owner@:rwxpcCosRrWaAdD:fd:allow,group@:rwxp:fd:allow,everyone@::fd:allow test1.dir # ls -Vd test1.dir drwxrwx---+ 2 root root 2 Dec 3 15:16 test1.dir owner@:rwxpdDaARWcCos:fd-----:allow group@:rwxp----------:fd-----:allow everyone@:--------------:fd-----:allow |
A file (file1) is created with requested permissions 0666. The resulting permissions are 0660. The execution permission was not inherited because the creation mode did not request it.
# touch test1.dir/file1 # ls -V test1.dir/file1 -rw-rw----+ 1 root root 0 Dec 3 15:17 file.1 owner@:rw-pdDaARWcCos:------I:allow group@:rw-p----------:------I:allow everyone@:--------------:------I:allow |
Next, an executable called t is generated by using the cc compiler in the testdir directory.
# cc -o t t.c # ls -V t -rwxrwx---+ 1 root root 7396 Dec 3 15:19 t owner@:rwxpdDaARWcCos:------I:allow group@:rwxp----------:------I:allow everyone@:--------------:------I:allow |
# cc -o t t.c # ls -V t -rwxrwx---+ 1 root root 7396 Dec 3 15:19 t owner@:rwxpdDaARWcCos:------:allow group@:rwxp----------:------:allow everyone@:--------------:------:allow |
The resulting permissions are 0770 because cc requested permissions 0777, which caused the execute permission to be inherited from the owner@, group@, and everyone@ entries.