Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to remove an ACL set for johndoe from all the folders recursively on one of my drives without hosing any other entries! Anyone know how to do this without affecting the ACLs that already exist for other groups/users?

I'm looking for the Mac equivalent of "setfacl -d u:johndoe"

I know you can use chmod to remove a rule from multiple files, but the only way I have seen won't work because it removes the rule via its index (eg: the 5th entry of every folder) and the entry for my user won't always be the same index.

Why would you want to do this? Say you inherit an insane file system that has a bunch of individual users instead of groups and you want to get rid of just the individuals since they already have access.

share|improve this question
up vote 1 down vote accepted

It's a bit long, but you can do something like this:

find . -exec chmod -a "johndoe allow delete,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown,read,write,append,execute,list,search,add_file,add_subdirectory,delete_child" {} \;

You'd also have to run the same command with "deny" to remove any prohibitive rules for the user.

Many thanks to Jesse Rusak on StackOverflow - this was cribbed from his answer.

share|improve this answer

I believe you may want -x instead of -d. Be sure and test this. Add -R for recursive.

setfacl -xR u:johndoe dirname
share|improve this answer
bash: setfacl: command not found – username May 14 '09 at 16:46
setfacl is not available for the Mac OS X, Apple has rolled their ACL management into chmod. – Chealion May 16 '09 at 16:40

If you're looking for a GUI application you can use Sandbox - you can then change the ACLs and apply it recursively if necessary but is a bit limited in terms of what you want to do.

That said setfacl is not available on a Mac - the capability is available through chmod to use chmod eg. chmod -R -a# [NumberOfACL] PATH or by specifying chmod -R -a [ACL to delete] PATH

If you specify username allow [ACL] as the ACL it is possible to remove the privileges one by one.

eg. chmod -R -a "username allow read" / will remove any read priveleges from any ACL available on any folder or file on the root hard drive. You can then rinse and repeat with the rest of the ACLs available, if you know that some are always together you can string them together eg. read,write (they must be comma delimited with no spaces).

The list of ACLs can be taken from the chmod man page (for brevity of the post) but by then placing each command (chmod -R -a "username [ACL whether it's allow or deny]") in a script you can remove all the ACLs by a single user from a folder and any subdirectories. Which you've got in the OP's answer now. (And a simpler way at that)

See the man page for the full details

share|improve this answer
chmod will set every single child folder to have the same permissions as it goes. that's the whole problem. and when i see "Sandbox cannot propagate an entry to a folder whose ACL is out of canonical order" in the FAQ it makes me think it can't do it either. it's easy to just "remove rule 3" all the way down - but not what i'm looking for – username May 10 '09 at 14:23
Definitely not ideal - the fact that OS X ACLs aren't the same as UNIX ACLs rises it's ugly head again. – Chealion May 10 '09 at 15:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.