FS_LISTACL(1)

📦
version 1.8.16.1 · 10 versions
, in ubuntu stonking

✨ FS_LISTACL(1) ✨

okay bestie, welcome to the AFS Command Reference 💖 this is fs_listacl, the little cutie whose whole job is showing you the access control lists. no cap.

🌸 NAME 🌸

fs_listacl — displays ACLs 💅

🦋 SYNOPSIS 🦋

fs listacl [-path <dir/file path>+] [-id] [-if] [-cmd] [-help]

fs la [-p <dir/file path>+] [-id] [-if] [-cmd] [-h]

fs lista [-p <dir/file path>+] [-id] [-if] [-cmd] [-h]

three names, one queen. listacl, la, lista — she answers to all of them 👑

🎀 DESCRIPTION 🎀

The fs listacl command shows you the access control list (that's ACL, iykyk) that belongs to each file, directory, or symbolic link you point at. 🫶

The element you name can live in the DFS filespace if whoever's running it is using the AFS/DFS Migration Toolkit Protocol Translator to get at DFS data (and yes, DFS does implement per-file ACLs, unlike some people 😭).

Wanna see the ACL of the directory you're literally standing in right now? Just leave off the -path argument. easy.

Wanna change an ACL? That's fs setacl. Wanna copy an ACL from one directory to another? That's fs copyacl. Wanna yeet stale entries out of an ACL? That's fs cleanacl. go off, use the right tool bestie 💖

💀 CAUTIONS 💀

this one's important, no skipping:

Putting a user or group on the "Negative rights" section of the ACL does not guarantee they get denied permissions — not if the "Normal rights" section already grants those permissions to members of the system:anyuser group. 🙈

In that case, the user just has to run the unlog command and boom, they've got the permissions granted to system:anyuser. so like... negative rights said no but anyuser said yes. the audacity.

💅 OPTIONS 💅

  • -path <dir/file path>+ — names each directory or file you want the ACL for. For AFS files, the output actually shows you the ACL from the file's parent directory (yes really, AFS is like that). DFS files do have their own ACL though, slay. Incomplete pathnames get interpreted relative to the current working directory, and fun fact: that's also the default value if you just... don't pass this argument at all. ✨
  • -id — shows the Initial Container ACL of each DFS directory. heads up: this one only works on DFS directories that are reached through the AFS/DFS Migration Toolkit Protocol Translator. 🧚
  • -if — shows the Initial Object ACL of each DFS directory. same deal — only supported on DFS directories accessed via the AFS/DFS Migration Toolkit Protocol Translator. 🧚
  • -cmd — spits out an fs setacl command string you can use to recreate the ACL that's applied to the file, directory, or symbolic link you specified. it's giving "make me a copy, but as a command." 🔥
  • -help — prints the online help for this command. every other valid option just gets ignored when you do this. periodt.

🌈 OUTPUT 🌈

For each file, directory, or symbolic link, the first line of output reads exactly like this:

Access list for <directory> is

tiny note: if whoever ran it used shorthand in the pathname — like the period (".") for the current current directory — that shorthand sometimes shows up instead of the full pathname of the directory. so don't be confused when you see it, bestie. 💜

Then the "Normal rights" header shows up, followed by a list of users and groups who are granted the permissions, one pairing of user/group and permissions per line.

If negative permissions got assigned to anyone, those entries come after a "Negative rights" header. the format of the negative entries is the same as the ones in the "Normal rights" section — the only difference is that the user or group is denied rather than granted the permissions. 💀

AFS does not implement per-file ACLs, so for a file the command just shows you the ACL on its directory. and for a symbolic link? the output shows the ACL that applies to its target file or directory — not the ACL on the directory that houses the symbolic link. sneaky little shortcut, honestly iconic.

The permissions for AFS let whoever holds them do the thing:

  • a (administer) — change the entries on the ACL.
  • d (delete) — remove files and subdirectories from the directory, or move them to other directories.
  • i (insert) — add files or subdirectories to the directory by copying, moving, or creating.
  • k (lock) — set read locks or write locks on the files in the directory.
  • l (lookup) — list the files and subdirectories in the directory, stat the directory itself, and issue the fs listacl command to examine the directory's ACL.
  • r (read) — read the contents of files in the directory; issue the "ls -l" command to stat the elements in the directory.
  • w (write) — modify the contents of files in the directory, and issue the UNIX chmod command to change their mode bits
  • A, B, C, D, E, F, G, H — have no default meaning to the AFS server processes, but they're made available for applications to use in controlling access to the directory's contents in additional ways. the letters must be uppercase. 🔠

For DFS files and directories the permissions are similar — with a few swaps you need to know about:

  • the DFS "x" (execute) permission replaces the AFS "l" (lookup) permission
  • DFS "c" (control) replaces AFS "a" (administer)
  • and there is no DFS equivalent to the AFS "k" (lock) permission

The meanings of the various permissions also differ slightly, and DFS does not implement negative permissions. for the full tea on DFS permissions, go check the DFS documentation. 📚

🍓 EXAMPLES 🍓

First one: this command shows the ACL on the home directory of the user "pat" (that's the current working directory), and on its "private" subdirectory.

% fs listacl -path . private
Access list for . is
Normal rights:
   system:authuser rl
   pat rlidwka
   pat:friends rlid
Negative rights:
   smith rlidwka
Access list for private is
Normal rights:
   pat rlidwka

Second one: this command generates the fs setacl command you'd need to recreate the ACL on the home directory of the user "pat" (the current working directory), and on its "private" subdirectory.

% fs listacl -path . private -cmd
fs setacl -dir . -acl system:authuser rl  pat rlidwka   pat:friends rlid
fs setacl -dir . -acl smith rlidwka -negative
fs setacl -dir private -acl pat rlidwka

see how it just hands you the commands?? so helpful. 💖

👑 PRIVILEGE REQUIRED 👑

depends what you're pointing at, so listen up:

  • If the -path argument names an AFS directory, you must have the "l" (lookup) permission on its ACL and on the ACL of every directory that comes before it in the pathname. 🌸
  • If the -path argument names an AFS file, you must have the "l" (lookup) and "r" (read) permissions on the ACL of the file's directory, plus the l permission on the ACL of each directory that comes before it in the pathname. 🌸
  • If the -path argument names a DFS directory or file, you must have the "x" (execute) permission on its ACL and on the ACL of each directory that comes before it in the pathname. 🌸

basically: know your permissions before you go poking around. ✨

🌟 SEE ALSO 🌟

fs_cleanacl(1), fs_copyacl(1), fs_setacl(1)

IBM Corporation 2000. <http://www.ibm.com/> All Rights Reserved.

This documentation is covered by the IBM Public License Version 1.0. It was converted from HTML to POD by software written by Chas Williams and Russ Allbery, based on work by Alf Wachsmann and Elizabeth Cassell.

and that's the whole page, bestie 💖 brought to you by OpenAFS, dated 2026-07-27. go look at some ACLs, you've got this. mwah 🎀✨💅

📦 where this page comes from