Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It's nice and all that one can "go crazy" adding and subtracting ACL's from files/folders till the cows come home... but when doing it from the command line, say for example..

$ chmod +a# 1 "admin deny delete" foo 
$ ls -lde foo 
 drwxr-xr-x + 2 apl apl 68 Jul 19 18:32 foo 
 0: group:admin allow delete 
 1: group:admin deny delete 
 2: user:tony allow delete

Is there an "easier" syntax that allows for "ALL" type scenarios? Since there are a total of 2^13 * 12 = 98,304 different access rights you can define it would be great if you could for example state...

$ chmod +a "staff allow all" foo 

But as far as I can tell, it ain't possible. Any extended-attribute gurus out there know of any tricks?

share|improve this question
up vote 2 down vote accepted

I'm not sure if this helps, but since you can have more than one permission per ACL, you could use a couple of environment variables (e.g. in your .profile) to make it easier. Assuming your default shell is bash:

export FILE_ALL="read,write,append,execute,delete,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown"
export DIR_ALL="list,search,add_file,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown"

Then when you need to grant permissions:

$ chmod +a "group:admin allow $FILE_ALL" foo
share|improve this answer
this works well, but didn't apply Write:Delete Subfolders + Files, Inheritance:Apply to Subfolders, and Inheritance:Apply to Enclosed Files. Is it just a matter of adding those "variables"? Do you know what they would be? – mralexgray Jun 4 '11 at 20:24
The permissions are listed in the chmod(1) man page. I would think Write:Delete Subfolders + Files should be covered by delete_child. Try modifying through the GUI and then checking with ls. The inherit_* permissions shouldn't necessarily be part of ALL - even chmod 777 doesn't pass on all permissions to all sub-files and folders. – Tom Shaw Jun 5 '11 at 0:19
i use this all the time BTW... is there any way to combine the two? – mralexgray Sep 10 '11 at 21:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.