summaryrefslogtreecommitdiff
path: root/docs/yodldocs/smbcacls.1.yo
diff options
context:
space:
mode:
authorTim Potter <tpot@samba.org>2000-12-14 04:57:14 +0000
committerTim Potter <tpot@samba.org>2000-12-14 04:57:14 +0000
commit478ffc48ee2e07d14abe85160c643752e1135b2e (patch)
treef66e6f804270b4a1435485c2ace312207834e6b2 /docs/yodldocs/smbcacls.1.yo
parent237e74730c4d28754d2cc8f531683513522a95a3 (diff)
downloadsamba-478ffc48ee2e07d14abe85160c643752e1135b2e.tar.gz
samba-478ffc48ee2e07d14abe85160c643752e1135b2e.tar.bz2
samba-478ffc48ee2e07d14abe85160c643752e1135b2e.zip
Updated smbcacls documentation.
(This used to be commit bd87398b5a9421add8db8b455d02ccd6b2624f58)
Diffstat (limited to 'docs/yodldocs/smbcacls.1.yo')
-rw-r--r--docs/yodldocs/smbcacls.1.yo89
1 files changed, 79 insertions, 10 deletions
diff --git a/docs/yodldocs/smbcacls.1.yo b/docs/yodldocs/smbcacls.1.yo
index d95ca6d387..249042ce2c 100644
--- a/docs/yodldocs/smbcacls.1.yo
+++ b/docs/yodldocs/smbcacls.1.yo
@@ -1,7 +1,7 @@
manpage(smbcacls htmlcommand((1)))(1)(3 Dec 2000)(Samba)(SAMBA)
label(NAME)
-manpagename(smbcacls)(Set or get ACLs on an NT file)
+manpagename(smbcacls)(Set or get ACLs on an NT file or directory )
label(SYNOPSIS)
manpagesynopsis()
@@ -20,33 +20,36 @@ SMB file shares.
label(OPTIONS)
manpageoptions()
-The following options are available to the bf(smbcacls) program:
+The following options are available to the bf(smbcacls) program. The
+format of ACLs is described in the section link(ACL FORMAT)(ACLFORMAT)
startdit()
label(minusA)
dit(bf(-A acls))
-Add the ACLs specified to the ACL list.
+Add the ACLs specified to the ACL list. Existing access control entries
+are unchanged.
label(minusM)
dit(bf(-M acls))
Modify the mask value (permissions) for the ACLs specified on the command
-line. An error will be printed if the ACL specified is not already present
-in the ACL list
+line. An error will be printed for each ACL specified that was not already
+present in the ACL list.
label(minusD)
dit(bf(-D acls))
-Delete any ACLs specfied on the command line. An error is printed if any
-of the ACLs specified are not present in the ACL list.
+Delete any ACLs specfied on the command line. An error will be printed for
+each ACL specified that was not already present in the ACL list.
label(minusS)
dit(bf(-S acls))
-This command deletes the current ACLs for the file or directory and
-replaces them with the ACLs specified on the command line.
+This command sets the ACLs on the file with only the ones specified on the
+command line. All other ACLs are erased. Note that the ACL specified must
+contain at least a revision, type, owner and group for the call to succeed.
label(minusU)
dit(bf(-U username))
@@ -72,7 +75,73 @@ Print usage information on the bf(smbcacls) program
enddit()
-label(EXIT STATUS)
+label(ACLFORMAT)
+manpagesection(ACL FORMAT)
+
+The format of an ACL is one or more ACL entries separated by either spaces,
+commas or newlines. An ACL entry is one of the following:
+
+verb(
+REVISION:<revision number>
+OWNER:<sid or name>
+GROUP:<sid or name>
+ACL:<sid or name>:<type>/<flags>/<mask>)
+
+The revision of the ACL specifies the internal Windows NT ACL revision for
+the security descriptor. If not specified it defaults to 1.
+
+The owner and group specify the owner and group sids for the object. If a
+SID in the format tt(S-1-x-y-z) is specified this is used, otherwise
+the name specified is resolved using the server on which the file or
+directory resides.
+
+ACLs specify permissions granted to the SID. This SID again can be
+specified in tt(S-1-x-y-z) format or as a name in which case it is resolved
+against the server on which the file or directory resides. The type, flags
+and mask values determine the type of access granted to the SID.
+
+The type can be either 0 or 1 corresponding to ALLOWED or DENIED access to
+the SID. The flags values are generally zero for file ACLs and either 9 or
+2 for directory ACLs. Some common flags are:
+
+verb(
+#define SEC_ACE_FLAG_OBJECT_INHERIT 0x1
+#define SEC_ACE_FLAG_CONTAINER_INHERIT 0x2
+#define SEC_ACE_FLAG_NO_PROPAGATE_INHERIT 0x4
+#define SEC_ACE_FLAG_INHERIT_ONLY 0x8)
+
+The mask is a value which expresses the access right granted to
+the SID. It can be given as a hexadecimal value or by using one of the
+following text strings which map to the NT file permissions of the same
+name.
+
+startdit()
+
+dit() tt(R) Allow read access
+
+dit() tt(W) Allow write access
+
+dit() tt(X) Execute permission on the object
+
+dit() tt(D) Delete the object
+
+dit() tt(P) Change permissions
+
+dit() tt(O) Take ownership
+
+enddit()
+
+The following combined permissions can be specified:
+
+startdit()
+
+dit() tt(READ) Equivalent to tt(RX) permissions
+dit() tt(CHANGE) Equivalent to tt(RXWD) permissions
+dit() tt(FULL) Equivalent to tt(RWXDPO) permissions
+
+enddit()
+
+label(EXITSTATUS)
manpagesection(EXIT STATUS)
label(AUTHOR)