From 478ffc48ee2e07d14abe85160c643752e1135b2e Mon Sep 17 00:00:00 2001 From: Tim Potter Date: Thu, 14 Dec 2000 04:57:14 +0000 Subject: Updated smbcacls documentation. (This used to be commit bd87398b5a9421add8db8b455d02ccd6b2624f58) --- docs/yodldocs/smbcacls.1.yo | 89 ++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 79 insertions(+), 10 deletions(-) (limited to 'docs/yodldocs') diff --git a/docs/yodldocs/smbcacls.1.yo b/docs/yodldocs/smbcacls.1.yo index d95ca6d387..249042ce2c 100644 --- a/docs/yodldocs/smbcacls.1.yo +++ b/docs/yodldocs/smbcacls.1.yo @@ -1,7 +1,7 @@ manpage(smbcacls htmlcommand((1)))(1)(3 Dec 2000)(Samba)(SAMBA) label(NAME) -manpagename(smbcacls)(Set or get ACLs on an NT file) +manpagename(smbcacls)(Set or get ACLs on an NT file or directory ) label(SYNOPSIS) manpagesynopsis() @@ -20,33 +20,36 @@ SMB file shares. label(OPTIONS) manpageoptions() -The following options are available to the bf(smbcacls) program: +The following options are available to the bf(smbcacls) program. The +format of ACLs is described in the section link(ACL FORMAT)(ACLFORMAT) startdit() label(minusA) dit(bf(-A acls)) -Add the ACLs specified to the ACL list. +Add the ACLs specified to the ACL list. Existing access control entries +are unchanged. label(minusM) dit(bf(-M acls)) Modify the mask value (permissions) for the ACLs specified on the command -line. An error will be printed if the ACL specified is not already present -in the ACL list +line. An error will be printed for each ACL specified that was not already +present in the ACL list. label(minusD) dit(bf(-D acls)) -Delete any ACLs specfied on the command line. An error is printed if any -of the ACLs specified are not present in the ACL list. +Delete any ACLs specfied on the command line. An error will be printed for +each ACL specified that was not already present in the ACL list. label(minusS) dit(bf(-S acls)) -This command deletes the current ACLs for the file or directory and -replaces them with the ACLs specified on the command line. +This command sets the ACLs on the file with only the ones specified on the +command line. All other ACLs are erased. Note that the ACL specified must +contain at least a revision, type, owner and group for the call to succeed. label(minusU) dit(bf(-U username)) @@ -72,7 +75,73 @@ Print usage information on the bf(smbcacls) program enddit() -label(EXIT STATUS) +label(ACLFORMAT) +manpagesection(ACL FORMAT) + +The format of an ACL is one or more ACL entries separated by either spaces, +commas or newlines. An ACL entry is one of the following: + +verb( +REVISION: +OWNER: +GROUP: +ACL:://) + +The revision of the ACL specifies the internal Windows NT ACL revision for +the security descriptor. If not specified it defaults to 1. + +The owner and group specify the owner and group sids for the object. If a +SID in the format tt(S-1-x-y-z) is specified this is used, otherwise +the name specified is resolved using the server on which the file or +directory resides. + +ACLs specify permissions granted to the SID. This SID again can be +specified in tt(S-1-x-y-z) format or as a name in which case it is resolved +against the server on which the file or directory resides. The type, flags +and mask values determine the type of access granted to the SID. + +The type can be either 0 or 1 corresponding to ALLOWED or DENIED access to +the SID. The flags values are generally zero for file ACLs and either 9 or +2 for directory ACLs. Some common flags are: + +verb( +#define SEC_ACE_FLAG_OBJECT_INHERIT 0x1 +#define SEC_ACE_FLAG_CONTAINER_INHERIT 0x2 +#define SEC_ACE_FLAG_NO_PROPAGATE_INHERIT 0x4 +#define SEC_ACE_FLAG_INHERIT_ONLY 0x8) + +The mask is a value which expresses the access right granted to +the SID. It can be given as a hexadecimal value or by using one of the +following text strings which map to the NT file permissions of the same +name. + +startdit() + +dit() tt(R) Allow read access + +dit() tt(W) Allow write access + +dit() tt(X) Execute permission on the object + +dit() tt(D) Delete the object + +dit() tt(P) Change permissions + +dit() tt(O) Take ownership + +enddit() + +The following combined permissions can be specified: + +startdit() + +dit() tt(READ) Equivalent to tt(RX) permissions +dit() tt(CHANGE) Equivalent to tt(RXWD) permissions +dit() tt(FULL) Equivalent to tt(RWXDPO) permissions + +enddit() + +label(EXITSTATUS) manpagesection(EXIT STATUS) label(AUTHOR) -- cgit