NFS4_SETFACL(1)

okay bestie, sit DOWN, we're learning nfs4_setfacl today 💅 this is the NFS4_SETFACL(1) page, straight out of the NFSv4 Access Control Lists corner of the manual, and honestly? it's giving powerful. let's go. ✨

---

🌸 NAME 🌸

nfs4_setfacl, nfs4_editfacl — they manipulate NFSv4 file/directory access control lists. that's the whole job. that's the vibe. 🎀

---

✨ SYNOPSIS ✨

nfs4_setfacl [OPTIONS] COMMAND file...
nfs4_editfacl [OPTIONS] file...

---

💖 DESCRIPTION 💖

nfs4_setfacl manipulates the NFSv4 Access Control List (ACL) of one or more files (or directories), as long as they're chillin' on a mounted NFSv4 filesystem that actually supports ACLs. no support, no service. 🙈

nfs4_editfacl is literally just nfs4_setfacl -e. same girl, different name. 👑

psst — go read the nfs4_acl(5) manpage for all the NFSv4 ACL terminology and syntax tea. it's the lore. iykyk. 🫶

🌈 COMMANDS 🌈

• -a acl_spec — add the ACEs from acl_spec to the file's ACL. they get inserted starting at the default position 1 of the file's ACL.
• -A acl_file — add the ACEs from the acl_spec sitting inside acl_file to the file's ACL. also inserted starting at the default position 1 of the file's ACL.
• -x acl_spec — delete the ACEs matched from acl_spec out of the file's ACL. ngl, the ordering of the ACEs in acl_spec does not matter here. 💀
• -X acl_file — delete the ACEs matched from the acl_spec inside acl_file out of the file's ACL. again, ordering of the ACEs in the acl_spec does not matter.
• -i index — ACEs get inserted or deleted starting at the *index*th position (DEFAULT: 1) of the file's ACL. it can be used only with the add or delete action, so don't try to be cute with it. 💅
• -s acl_spec — set the file's ACL to acl_spec.
• -S acl_file — set the file's ACL to the acl_spec in acl_file.
• -e, --edit — edit the file's ACL in the editor defined in the EDITOR environment variable (DEFAULT: vi(1)) and set the resulting ACL upon a clean exit, assuming the changes made in the editor were saved. heads up bestie: if multiple files are specified, the editor will be serially invoked once per file. one at a time. patience. 🧚
• -m from_ace to_ace — modify the file's ACL in-place by replacing from_ace with to_ace.
• -?, -h, --help — display help text and exit. we love a helpful icon. 🌟
• --version — display this program's version and exit.

NOTE: if - is given as the acl_file with the -A/-X/-S flags, the acl_spec will be read from stdin. 👀

---

🦋 OPTIONS 🦋

• -R, --recursive — recursively apply to a directory's files and subdirectories. similar to setfacl(1), the default behavior is to follow symlinks given on the command line and to skip symlinks encountered while recursing through directories.
• -L, --logical — in conjunction with -R/--recursive, a logical walk follows all symbolic links. all of them. no skips. 🐇
• -P, --physical — in conjunction with -R/--recursive, a physical walk skips all symbolic links. none of them. 🚫
• --dacl — acts on the dacl only. this functionality is only available if the server supports NFSv4 minor version 1 or newer. no minor version 1, no dacl, sorry bestie. 😭
• --sacl — acts on the sacl only. same deal: only available if the server supports NFSv4 minor version 1 or newer.
• --test — display results of COMMAND, but do not save changes. it's a lil preview. a sneak peek. a vibe check. 🔥

---

👑 PERMISSIONS ALIASES 👑

with nfs4_setfacl, you can use simple abbreviations ("aliases") to express generic "read" (R), generic "write" (W), and generic "execute" (X) permissions, familiar from the POSIX mode bits used by, e.g., chmod(1). iconic lineage, honestly. to use these aliases, you can put them in the permissions field of an NFSv4 ACE and nfs4_setfacl will convert them:

• an R is expanded to rntcy
• a W is expanded to watTNcCy (with D added to directory ACEs)
• an X is expanded to xtcy

please refer to the nfs4_acl(5) manpage for info on specific NFSv4 ACE permissions. 📚

for example, if you wanted to grant generic "read" and "write" access on a file, the NFSv4 permissions field would normally contain something like rwatTnNcCy. instead, you might use aliases to accomplish the same goal with RW. same energy, less typing. slay. 💅

the two permissions not included in any of the aliases are d (delete) and o (write-owner). but you can still use them! e.g., a permissions field consisting of Wdo expresses generic "write" access <em>as well as</em> the ability to delete and change ownership. periodt. 💖

---

🌟 EXAMPLES 🌟

assume that the file foo has the following NFSv4 ACL for the following examples:

A::OWNER@:rwatTnNcCy
D::OWNER@:x
A:g:GROUP@:rtncy
D:g:GROUP@:waxTC
A::EVERYONE@:rtncy
D::EVERYONE@:waxTC

• add ACE granting alice@nfsdomain.org generic "read" and "execute" access (defaults to prepending ACE to ACL):

$ nfs4_setfacl -a A::alice@nfsdomain.org:rxtncy foo

• add the same ACE as above, but using aliases:

$ nfs4_setfacl -a A::alice@nfsdomain.org:RX foo

• add the same ACE as above, at index 2:

$ nfs4_setfacl -i 2 -a A::alice@nfsdomain.org:RX foo

• edit existing ACL in a text editor and set modified ACL on clean save/exit:

$ nfs4_setfacl -e foo

• set ACL (overwrites original) to contents of a spec_file named newacl.txt:

$ nfs4_setfacl -S newacl.txt foo

• recursively set the ACLs of all files and subdirectories in the current directory, skipping all symlinks encountered, to the ACL contained in the spec_file named newacl.txt:

$ nfs4_setfacl -R -P -S newacl.txt *

• delete the first ACE, but only print the resulting ACL (does not save changes):

$ nfs4_setfacl --test -x 1 foo

• delete the last two ACEs above:

$ nfs4_setfacl -x A::EVERYONE@rtncy,D::EVERYONE@:waxTC foo

• modify (in-place) the second ACE above:

$ nfs4_setfacl -m D::OWNER@:x  D::OWNER@:xo foo

• set ACLs of bar and frobaz to ACL of foo:

$ nfs4_getfacl foo | nfs4_setfacl -S - bar frobaz

---

🎀 AUTHORS 🎀

nfs4_setfacl was written by people at CITI, the Center for Information Technology Integration (http://www.citi.umich.edu). this manpage was written by David Richter. absolute legends, we stan. 🫶

---

💌 CONTACT 💌

please send bug reports, feature requests, and comments to <nfsv4@linux-nfs.org>. they want to hear from you fr fr. 📬

---

🔗 SEE ALSO 🔗

nfs4_getfacl(1), nfs4_acl(5), RFC3530 (NFSv4.0), NFSv4.1 Minor Version Draft.

---

and that's the whole page bestie, you ate that 💅 this was version 0.3.4, August 2018, living under the Linux banner — ok bye love u, go set some ACLs responsibly 🦋✨💖