Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

It's nice and all that one can "go crazy" adding and subtracting ACL's from files/folders till the cows come home... but when doing it from the command line, say for example..

$ chmod +a# 1 "admin deny delete" foo 
$ ls -lde foo 
 drwxr-xr-x + 2 apl apl 68 Jul 19 18:32 foo 
 0: group:admin allow delete 
 1: group:admin deny delete 
 2: user:tony allow delete

Is there an "easier" syntax that allows for "ALL" type scenarios? Since there are a total of 2^13 * 12 = 98,304 different access rights you can define it would be great if you could for example state...

$ chmod +a "staff allow all" foo 

But as far as I can tell, it ain't possible. Any extended-attribute gurus out there know of any tricks?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

I'm not sure if this helps, but since you can have more than one permission per ACL, you could use a couple of environment variables (e.g. in your .profile) to make it easier. Assuming your default shell is bash:

export FILE_ALL="read,write,append,execute,delete,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown"
export DIR_ALL="list,search,add_file,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown"

Then when you need to grant permissions:

$ chmod +a "group:admin allow $FILE_ALL" foo
share|improve this answer
    
this works well, but didn't apply Write:Delete Subfolders + Files, Inheritance:Apply to Subfolders, and Inheritance:Apply to Enclosed Files. Is it just a matter of adding those "variables"? Do you know what they would be? –  mralexgray Jun 4 '11 at 20:24
    
The permissions are listed in the chmod(1) man page. I would think Write:Delete Subfolders + Files should be covered by delete_child. Try modifying through the GUI and then checking with ls. The inherit_* permissions shouldn't necessarily be part of ALL - even chmod 777 doesn't pass on all permissions to all sub-files and folders. –  Tom Shaw Jun 5 '11 at 0:19
    
i use this all the time BTW... is there any way to combine the two? –  mralexgray Sep 10 '11 at 21:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.