CHACL(1)

👑 CHACL — the ACL glow-up command

okay bestie, so this is chacl, from section 1 of the manual (the Access Control Lists corner of the man pages, if you will). It changes the access control list of a file or directory. Yes, that ACL. The permission system's cooler older cousin. Let's get into it 💅

✨ NAME ✨

chacl — change the access control list of a file or directory. literally that's her whole job 🎀

🦋 SYNOPSIS 🦋

chacl acl pathname...
chacl -b acl dacl pathname...
chacl -d dacl pathname...
chacl -R pathname...
chacl -D pathname...
chacl -B pathname...
chacl -l pathname...
chacl -r pathname...

🌸 DESCRIPTION 🌸

So. chacl is an IRIX-compatibility command, and she's kept alive for the girlies who already know her from either XFS or IRIX. If you want tools that conform more closely to the (withdrawn draft) POSIX 1003.1e standard — the one that actually describes Access Control Lists (ACLs) — scroll your cute self down to the SEE ALSO section below, okay? 🫶

chacl changes the ACL(s) for a file or directory. The ACL(s) you specify get applied to each file in the pathname arguments. Every single one. She does not play favorites 💖

Each ACL is a string, and it gets interpreted using the acl_from_text(3) routine. These strings are made up of comma separated clauses, each one looking like this:

tag:name:perm

And tag can be any of these icons:

• "user" (or "u") — indicating that the entry is a "user" ACL entry.
• "group" (or "g") — indicating that the entry is a "group" ACL entry.
• "other" (or "o") — indicating that the entry is an "other" ACL entry.
• "mask" (or "m") — indicating that the entry is a "mask" ACL entry.

name is a string, and it's the user or group name for the ACL entry. And here's the tea: a null name in a user or group ACL entry means the file's owner or the file's group, no cap.

perm is the string "rwx", where each of the entries may be replaced by a "-" indicating no access of that type, e.g. "r-x", "--x", "---". It's giving permission bingo 🌈

💅 OPTIONS 💅

• -b — Indicates that there are two ACLs to change: the first is the file access ACL and the second is the directory default ACL. Two for the price of one, iconic.
• -d — Used to set only the default ACL of a directory.
• -R — Removes the file access ACL only.
• -D — Removes the directory default ACL only.
• -B — Remove all ACLs. Everything. Gone. Bye 👋
• -l — Lists the access ACL and possibly the default ACL associated with the specified files or directories. Heads up bestie: this option was added during the Linux port of XFS, and it is not IRIX compatible.
• -r — Set the access ACL recursively for each subtree rooted at pathname(s). Same disclaimer: this one was also added during the Linux port of XFS, and it's not compatible with IRIX either.

🎀 EXAMPLES 🎀

A minimum ACL, the little baby starter ACL:

chacl u::rwx,g::r-x,o::r-- file

The file ACL is set so that the file's owner has "rwx", the file's group has read and execute, and others have read only access to the file. Simple, clean, slay ✨

An ACL that is not a minimum ACL — meaning one that specifies a user or group other than the file's owner or owner's group — must contain a mask entry:

chacl u::rwx,g::r-x,o::r--,u:bob:r--,m::r-x file1 file2

And if you want to set the default and access ACLs on newdir to be the same as on olddir, you could type:

chacl -b `chacl -l olddir | \
    sed -e 's/.*\[//' -e 's#/# #' -e 's/]$//'` newdir

The way that backtick-command-substitution-sed-pipeline ate, honestly 🔥

🚨 CAUTIONS 🚨

chacl can replace the existing ACL. Like, fully replace it. If you want to add or delete entries, you must first do chacl -l to get the existing ACL, and use the output to form the arguments to chacl. Do not skip this step, I am begging you 😭

Changing the permission bits of a file will change the file access ACL settings (see chmod(1)). However, file creation mode masks (see umask(1)) will not affect the access ACL settings of files created using directory default ACLs. Two very different vibes, don't mix them up 🙈

ACLs are filesystem extended attributes and hence are not typically archived or restored using the conventional archiving utilities. See attr(5) for more information about extended attributes, and see xfsdump(8) for a method of backing them up under XFS. Back up your ACLs, bestie, future you will thank present you 💜

👀 SEE ALSO 👀

getfacl(1), setfacl(1), chmod(1), umask(1), acl_from_text(3), acl(5), xfsdump(8)

okay that's the whole page!! 🦋 this little gem comes from the ACL File Utilities — page dated September 2001 — and honestly she's still out here doing her thing. go forth and ACL responsibly, bestie. mwah 💖🎀✨