FS_CLEANACL(1)

📦
version 1.8.16.1 · 10 versions
, in ubuntu stonking

✨ FS_CLEANACL(1) ✨

okay bestie, welcome to the AFS Command Reference 💖 today we're talking about fs_cleanacl — she's from the OpenAFS girlies and she's here to clean house 🧹✨

🌸 NAME 🌸

fs_cleanacl — remove obsolete entries from an ACL 💅

🦋 SYNOPSIS 🦋

fs cleanacl [-path <dir/file path>+] [-help]

fs cl [-p <dir/file path>+] [-h]

💖 DESCRIPTION 💖

So the way that fs cleanacl works is: she goes through the access control list (ACL) of every directory or file you point her at, and she removes any entry that refers to a user or group that no longer has a Protection Database entry. no cap. that entry is just… sitting there 💀

And here's the tell — an entry like that shows up on the ACL as an AFS user ID number (UID) instead of a name. why? because without a Protection Database entry, the File Server literally cannot translate the UID into a name. it's giving ghost 👻

Cleaning ACLs like this does two things, and both are lowkey important:

  • it stops them from getting all crowded with irrelevant information (vibe check: passed ✨)
  • it also stops the new possessor of a recycled AFS UID from getting access that was intended for the former possessor of that AFS UID. 😭 not the hand-me-down permissions
heads up bestie: recycling UIDs is not recommended in any case. like, at all. periodt.

👑 OPTIONS 👑

  • -path <dir/file path>+ — names each directory whose ACL you want cleaned. (and yes, if you give a filename, it cleans its directory's ACL — that's just how she rolls 🎀) If you omit this argument entirely, the current working directory's ACL gets cleaned.

✨ pro tip from the girlies: specify the read/write path to each directory, so you don't hit that failure that comes from trying to change a read-only volume. by convention, the read/write path is indicated by putting a period before the cell name at the pathname's second level, like /afs/.example.com. for the whole deep-dive on read/write vs read-only paths through the filespace, go read the fs mkmount reference page, iykyk 🦋

  • -help — prints the online help for this command. all other valid options are ignored when you use this one. she said "one thing at a time" 💅

🌈 OUTPUT 🌈

If there are no obsolete entries on the ACL, you get this little angel message:

Access list for <path> is fine.

But if there are obsolete entries? then the output reports the resulting state of the ACL, following this header:

Access list for <path> is now

And at the same time, you'll get this error message for each file in the cleaned directories:

fs: '<filename>': Not a directory

(it's not personal, she's just built that way 🙈)

🍓 EXAMPLES 🍓

okay so here's the glow-up in action. this example cleans the ACLs on the current working directory and two of its subdirectories. spoiler: only the second subdirectory had obsolete entries on it. main character energy only for ./sources 👑

% fs cleanacl -path . ./reports ./sources
Access list for . is fine.
Access list for ./reports is fine.
Access list for ./sources is now
Normal rights:
   system:authuser rl
   pat rlidwka

look at that ACL. immaculate. ✨

🔥 PRIVILEGE REQUIRED 🔥

The issuer must have the "a" (administer) permission on each directory's ACL — or on the ACL of each file's parent directory. 🫶

And no, the directory's owner and the members of the system:administrators group don't need to stress, because they have the right implicitly, even if it does not appear on the ACL. they're just like that 💜

⭐ SEE ALSO ⭐

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

This documentation is covered by the IBM Public License Version 1.0. It was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.

that's the whole page bestie, you ate that reading session 💖 this was OpenAFS, dated 2026-07-27, and honestly? iconic. go clean those ACLs. mwah 😭💅🌸

📦 where this page comes from