ACL Entry Descriptions

Use the following sample entry as a reference to understand the elements that comprise an ACL entry. These elements apply to both trivial and non-trivial ACLs.

0:user:jan:read_data/write_data:file_inherit:allow

Index

A number at the beginning of the entry, such as the number zero (0) in the example. The index identifies a specific entry and distinguishes the entry from others in the ACL.

ACL entry type

The user category. In trivial ACLs, only entries for owner@, group@, and everyone@ are set. In non-trivial ACLs, user:username and group:groupname are added. In the example, the entry type is user:jan.

Access privileges

Permissions that are granted or denied to the entry type. In the example, user Jan's permissions are read_data and write_data.

Inheritance flags

An optional list of ACL flags that control how permissions are propagated in a directory structure, including flags that audit access to files and directories. In the sample entry, file_inherit is also granted to user Jan.

Audit flag

An optional flag that enables you to audit access and changes that are being made to a file.

Permission control

Determines whether the permissions in an entry are allowed or denied. In the example, the permissions for Jan are allowed.

The following table describes each ACL entry type.

Table 2-1 ACL Entry Types

ACL Entry Type	Format	Description
owner@	Trivial	Specifies the access granted to the owner of the object.
group@	Trivial	Specifies the access granted to the owning group of the object.
everyone@	Trivial	Specifies the access granted to any user or group that does not match any other ACL entry.
user	Non-trivial	With a user name, specifies the access granted to an additional user of the object. Must include the ACL-entry-ID, which contains a user name or user ID. If the value is not a valid numeric UID or user name, the ACL entry type is invalid.
group	Non-trivial	With a group name, specifies the access granted to an additional group of the object. Must include the ACL entry ID, which contains a group name or group ID. If the value is not a valid numeric GID or group name, the ACL entry type is invalid.

The following table describes ACL access privileges.

Table 2-2 ACL Access Privileges

Access Privilege	Compact Access Privilege	Description
add_file	w	Permission to add a new file to a directory.
add_subdirectory	p	On a directory, permission to create a subdirectory.
append_data	p	On a file, permission to modify from the end of the file (EOF).
delete	d	Permission to delete a file. For more information about specific delete permission behavior, see Table 2-3.
delete_child	D	Permission to delete a file or directory within a directory. For more information about specific delete_child permission behavior, see Table 2-3.
execute	x	Permission to execute a file or search the contents of a directory.
list_directory	r	Permission to list the contents of a directory.
read_acl	c	Permission to read the ACL (ls).
read_attributes	a	Permission to read basic attributes (non-ACLs) of a file, which are equivalent to stat level attributes. Allowing this access mask bit means the entity can execute ls(1) and stat(2).
read_data	r	Permission to read the contents of the file.
read_xattr	R	Permission to read the extended attributes of a file or perform a lookup in the file's extended attributes directory.
synchronize	s	Permission to access a file locally at the ZFS server with synchronized read and write operations.
write_xattr	W	Permission to create extended attributes or write to the extended attributes directory. Granting this permission to a user means that the user can create an extended attribute directory for a file. The attribute file's permissions control the user's access to the attribute.
write_data	w	Permission to modify or replace the contents of a file.
write_attributes	A	Permission to change the times associated with a file or directory to an arbitrary value.
write_acl	C	Permission to write the ACL or the ability to modify the ACL by using the chmod command.
write_owner	o	Permission to change the file's owner or group. Or, the ability to execute the chown or chgrp commands on the file. Permission to take ownership of a file or permission to change the group ownership of the file to a group of which the user is a member. If you want to change the file or group ownership to an arbitrary user or group, then the PRIV_FILE_CHOWN privilege is required.

The following table provides additional details about ACL delete and delete_child behavior.

Table 2-3 ACL delete and delete_child Permission Behavior

Parent Directory Permissions	Target Object Permissions
" " (empty)	ACL allows delete	ACL denies delete	Delete permission unspecified
ACL allows delete_child	Permit	Permit	Permit
ACL denies delete_child	Permit	Deny	Deny
ACL allows only write and execute	Permit	Permit	Permit
ACL denies write and execute	Permit	Deny	Deny