setcifsacl(1)

💖 setcifsacl — the girlies' guide 💖

okay bestie, welcome to setcifsacl(1), straight out of the General Commands Manual section 1. pull up a chair, grab a strawberry 🍓, we're editing security descriptors today and honestly? iconic.

---

✨ NAME ✨

setcifsacl — a userspace helper that alters components of a security descriptor for the Common Internet File System (CIFS). no cap. that's the whole job. 💅

---

🌸 SYNOPSIS 🌸

setcifsacl [-v|-U|-a|-A|-D|-M|-S|-o|-g] "{one or more ACEs or a SID}"
{file system object}

---

🦋 DESCRIPTION 🦋

so, first thing's first: this tool is part of the cifs-utils suite. she's one of the family. 🫶

setcifsacl is a userspace helper program for the Linux CIFS client file system. her whole vibe is altering an ACL, or setting the owner/group SID of a security descriptor, for a file system object.

⚠️ okay important, listen up: whether a security descriptor that you're trying to set actually gets applied or not is decided by the CIFS/SMB server. not you. not this program. the server is the main character here and she has final say. 💀

also, this program uses a plugin to handle the mapping of user and group names to SIDs. and btw:

/etc/cifs-utils/idmap-plugin

...should be a symlink that points to the correct plugin to use. it's giving "one symlink to rule them all". 🔥

---

💅 OPTIONS 💅

• -h — print the usage message and dip. that's it, that's the whole thing. ✨
• -v — print the version number and exit. bye bestie 👋
• -U — apply the ACE editing actions (-a, -D, -M, -S) to the SACL (that's the aUdit ACL, cutie). if you don't pass -U, the actions get applied to the DACL instead. choose your fighter. 🥊
• -a — add one or more ACEs to an ACL of a security descriptor. and like, an ACE gets added even if the same ACE already exists in the ACL. no deduplication, no vibe check, she just goes in. 😌
• -A — add one or more ACEs to the ACL of a security descriptor, but this time while maintaining the preferred order of the ACEs. the preferred order of ACEs is described in the following documentation: <https://docs.microsoft.com/en-us/windows/win32/secauthz/order-of-aces-in-a-dacl> — go read it, she ate.
• -D — delete one or more ACEs from an ACL of a security descriptor. and this is the strict part: the entire ACE has to match in the existing ACL for the listed ACEs to get deleted. partial matches? not today. 🔍
• -M — modify one or more ACEs from an ACL of a security descriptor. SID and type are used to match existing ACEs, which then get modified with the list of ACEs you specified. matcha latte, but make it permissions. 🍵
• -S — set an ACL of a security descriptor with the list of ACEs. the existing ACL is replaced entirely with the specified ACEs. like, full makeover, old ACL is gone gone. 💀
• -o — set the owner SID to the one you specified as a command line argument.
• -g — set the group SID to the one you specified as a command line argument.

now here's the tea on how to actually write these things:

the owner/group SID can be specified as a name or as a raw SID value. every ACE entry starts with "ACL:". one or more ACEs get specified inside double quotes. multiple ACEs are separated by a comma. commas are the friendship bracelets of ACEs. 🎀

following fields of a DACL ACE can be modified, with these possible values:

• SID — either a name or a raw SID value.
• type — ALLOWED (0x0), DENIED (0x1), OBJECT_ALLOWED (0x5), OBJECT_DENIED (0x6)
• flags — OBJECT_INHERIT_FLAG (OI or 0x1), CONTAINER_INHERIT_FLAG (CI or 0x2), NO_PROPAGATE_INHERIT_FLAG (NI or 0x4), INHERIT_ONLY_FLAG (IO or 0x8), INHERITED_ACE_FLAG (IA or 0x10), or a combination/OR of these values.
• mask — either one of FULL, CHANGE, READ, a combination of R W X D P O, or a hex value.

following fields of a SACL ACE can be modified, with these possible values:

• SID — either a name or a raw SID value.
• type — AUDIT (0x2), AUDIT_OBJECT (0x7), AUDIT_CALLBACK (0xD), AUDIT_CALLBACK_OBJECT (0xF), MANDATORY_LABEL (0x11), RESOURCE_ATTRIBUTE (0x12), SCOPED_POLICY_ID (0x13)
• flags — SUCCESSFULL_ACCESS (SA or 0x40), FAILED_ACCESS (FA or 0x80)
• mask — either one of FULL, CHANGE, READ, a combination of R W X D P O, or a hex value.

---

🌈 EXAMPLES 🌈

these are the moments. let's go. 👑

🎀 Add an ACE

setcifsacl -a "ACL:CIFSTESTDOM\user2:DENIED/0x1/D" <file_name>

setcifsacl -a "ACL:CIFSTESTDOM\user1:ALLOWED/OI|CI|NI/D" <file_name>

setcifsacl -U -a "ACL:CIFSTESTDOM\user1:AUDIT/SA/D" <file_name>

🎀 Add an ACE and reorder ACL

setcifsacl -A "ACL:CIFSTESTDOMuser3:ALLOWED/OI/FULL" <file_name>
setcifsacl -A "ACL:CIFSTESTDOMuser2:DENIED/0x1/D" <file_name>
setcifsacl -A "ACL:CIFSTESTDOMuser1:ALLOWED/OI|CI|NI/D" <file_name>

after setting the above mentioned ACEs, below is the output of getcifsacl:

ACL:CIFSTESTDOMuser2:DENIED/0x1/D
ACL:CIFSTESTDOMuser3:ALLOWED/OI/FULL
ACL:CIFSTESTDOMuser1:ALLOWED/OI|CI|NI/D

see how she reordered herself? that's the -A magic, fr fr. ✨

🎀 Delete an ACE

setcifsacl -D "ACL:S-1-1-0:0x1/OI/0x1201ff" <file_name>

setcifsacl -U -D "ACL:S-1-1-0:0x2/FA/0xf01ff" <file_name>

🎀 Modify an ACE

setcifsacl -M "ACL:CIFSTESTDOM\user1:ALLOWED/0x1f/CHANGE" <file_name>

setcifsacl -U -M "ACL:CIFSTESTDOM\user1:AUDIT_OBJECT/SA/CHANGE"
<file_name>

🎀 Set an ACL

setcifsacl -S
"ACL:CIFSTESTDOM\Administrator:0x0/0x0/FULL,ACL:CIFSTESTDOM\user2:0x0/0x0/FULL"
<file_name>

setcifsacl -U -S
"ACL:CIFSTESTDOM\Administrator:AUDIT/SA/FULL,ACL:CIFSTESTDOM\user2:0x7/0x80/FULL"
<file_name>

🎀 Set owner SID

setcifsacl -o "S-1-5-21-3338130290-3403600371-1423429424-2102"
<file_name>

🎀 Set group SID

setcifsacl -g "<Administrators@BUILTIN>" <file_name>

---

🧚 NOTES 🧚

kernel support for the getcifsacl/setcifsacl utilities was initially introduced in the 2.6.37 kernel. so if you're on something older... bestie. 😭

---

⭐ SEE ALSO ⭐

mount.cifs(8), getcifsacl(1)

---

👑 AUTHOR 👑

Shirish Pargaonkar wrote the setcifsacl program. legend behavior, honestly. 🫡

the Linux CIFS Mailing list is the preferred place to ask questions regarding these programs. so if you've got questions, that's where the group chat lives. 💌

---

and that's the whole page, bestie — this was setcifsacl(1) from the General Commands Manual, and she said what she said. go forth and fix your ACLs, you absolute icon. 🦋✨💖