| blob | 3cb0d33ab16e3767521f35fbf541df8393a7d902 |
1 .\"
2 .\" Sun Microsystems, Inc. gratefully acknowledges The Open Group for
3 .\" permission to reproduce portions of its copyrighted documentation.
4 .\" Original documentation from The Open Group can be obtained online at
5 .\" http://www.opengroup.org/bookstore/.
6 .\"
7 .\" The Institute of Electrical and Electronics Engineers and The Open
8 .\" Group, have given us permission to reprint portions of their
9 .\" documentation.
10 .\"
11 .\" In the following statement, the phrase ``this text'' refers to portions
12 .\" of the system documentation.
13 .\"
14 .\" Portions of this text are reprinted and reproduced in electronic form
15 .\" in the SunOS Reference Manual, from IEEE Std 1003.1, 2004 Edition,
16 .\" Standard for Information Technology -- Portable Operating System
17 .\" Interface (POSIX), The Open Group Base Specifications Issue 6,
18 .\" Copyright (C) 2001-2004 by the Institute of Electrical and Electronics
19 .\" Engineers, Inc and The Open Group. In the event of any discrepancy
20 .\" between these versions and the original IEEE and The Open Group
21 .\" Standard, the original IEEE and The Open Group Standard is the referee
22 .\" document. The original Standard can be obtained online at
23 .\" http://www.opengroup.org/unix/online.html.
24 .\"
25 .\" This notice shall appear on any product containing this material.
26 .\"
27 .\" The contents of this file are subject to the terms of the
28 .\" Common Development and Distribution License (the "License").
29 .\" You may not use this file except in compliance with the License.
30 .\"
31 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
32 .\" or http://www.opensolaris.org/os/licensing.
33 .\" See the License for the specific language governing permissions
34 .\" and limitations under the License.
35 .\"
36 .\" When distributing Covered Code, include this CDDL HEADER in each
37 .\" file and include the License file at usr/src/OPENSOLARIS.LICENSE.
38 .\" If applicable, add the following below this CDDL HEADER, with the
39 .\" fields enclosed by brackets "[]" replaced with your own identifying
40 .\" information: Portions Copyright [yyyy] [name of copyright owner]
41 .\"
42 .\"
43 .\" Copyright 1989 AT&T.
44 .\" Portions Copyright (c) 1992, X/Open Company Limited All Rights Reserved
45 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved.
46 .\" Copyright 2014 Nexenta Systems, Inc. All rights reserved.
47 .\"
48 .TH CHMOD 1 "Nov 24, 2014"
49 .SH NAME
50 chmod \- change the permissions mode of a file
51 .SH SYNOPSIS
52 .LP
53 .nf
54 \fBchmod\fR [\fB-fR\fR] \fIabsolute-mode\fR \fIfile\fR ...
55 .fi
57 .LP
58 .nf
59 \fBchmod\fR [\fB-fR\fR] \fIsymbolic-mode-list\fR \fIfile\fR ...
60 .fi
62 .LP
63 .nf
64 \fBchmod\fR [\fB-fR\fR] \fIacl_operation\fR \fIfile\fR ...
65 .fi
67 .LP
68 .nf
69 \fBchmod\fR [\fB-fR\fR] [\fB-@\fR \fInamed_attribute\fR]...\fIattribute_specification_list\fR \fIfile\fR ...
70 .fi
72 .SH DESCRIPTION
73 .LP
74 The \fBchmod\fR utility changes or assigns the mode of a file.
75 .sp
76 .LP
77 \fBchmod\fR can also be used to modify Access Control Lists (ACLs) on files and
78 directories, and to modify boolean read-write system attributes on regular
79 files, directories, and opaque extended attribute files.
80 .SS "Absolute Mode"
81 .LP
82 An absolute mode command line has the following format:
83 .sp
84 .LP
85 \fBchmod\fR [\fIoptions\fR] \fIabsolute-mode\fR \fIfile\fR ...
86 .sp
87 .LP
88 where \fIabsolute-mode\fR is specified using octal numbers \fInnnn\fR defined
89 as follows:
90 .sp
91 .ne 2
92 .na
93 \fB\fIn\fR\fR
94 .ad
95 .RS 5n
96 a number from \fB0\fR to \fB7\fR. An absolute mode is constructed from the OR
97 of any of the following modes:
98 .sp
99 .ne 2
100 .na
101 \fB\fB4000\fR\fR
102 .ad
103 .RS 12n
104 Set user \fBID\fR on execution.
105 .RE
107 .sp
108 .ne 2
109 .na
110 \fB\fB20\fR\fI\|#\|\fR\fB0\fR\fR
111 .ad
112 .RS 12n
113 Set group \fBID\fR on execution if \fI#\fR is \fB7\fR, \fB5\fR, \fB3\fR, or
114 \fB1\fR.
115 .sp
116 Enable mandatory locking if \fI#\fR is \fB6\fR, \fB4\fR, \fB2\fR, or \fB0\fR.
117 .sp
118 For directories, files are created with BSD semantics for propagation of the
119 group ID. With this option, files and subdirectories created in the directory
120 inherit the group ID of the directory, rather than of the current process. For
121 directories, the set-gid bit can only be set or cleared by using symbolic mode.
122 .RE
124 .sp
125 .ne 2
126 .na
127 \fB\fB1000\fR\fR
128 .ad
129 .RS 12n
130 Turn on sticky bit. See \fBchmod\fR(2).
131 .RE
133 .sp
134 .ne 2
135 .na
136 \fB\fB0400\fR\fR
137 .ad
138 .RS 12n
139 Allow read by owner.
140 .RE
142 .sp
143 .ne 2
144 .na
145 \fB\fB0200\fR\fR
146 .ad
147 .RS 12n
148 Allow write by owner.
149 .RE
151 .sp
152 .ne 2
153 .na
154 \fB\fB0100\fR\fR
155 .ad
156 .RS 12n
157 Allow execute (search in directory) by owner.
158 .RE
160 .sp
161 .ne 2
162 .na
163 \fB\fB0700\fR\fR
164 .ad
165 .RS 12n
166 Allow read, write, and execute (search) by owner.
167 .RE
169 .sp
170 .ne 2
171 .na
172 \fB\fB0040\fR\fR
173 .ad
174 .RS 12n
175 Allow read by group.
176 .RE
178 .sp
179 .ne 2
180 .na
181 \fB\fB0020\fR\fR
182 .ad
183 .RS 12n
184 Allow write by group.
185 .RE
187 .sp
188 .ne 2
189 .na
190 \fB\fB0010\fR\fR
191 .ad
192 .RS 12n
193 Allow execute (search in directory) by group.
194 .RE
196 .sp
197 .ne 2
198 .na
199 \fB\fB0070\fR\fR
200 .ad
201 .RS 12n
202 Allow read, write, and execute (search) by group.
203 .RE
205 .sp
206 .ne 2
207 .na
208 \fB\fB0004\fR\fR
209 .ad
210 .RS 12n
211 Allow read by others.
212 .RE
214 .sp
215 .ne 2
216 .na
217 \fB\fB0002\fR\fR
218 .ad
219 .RS 12n
220 Allow write by others.
221 .RE
223 .sp
224 .ne 2
225 .na
226 \fB\fB0001\fR\fR
227 .ad
228 .RS 12n
229 Allow execute (search in directory) by others.
230 .RE
232 .sp
233 .ne 2
234 .na
235 \fB\fB0007\fR\fR
236 .ad
237 .RS 12n
238 Allow read, write, and execute (search) by others.
239 .RE
241 .RE
243 .sp
244 .LP
245 For directories, the \fBsetgid\fR bit cannot be set (or cleared) in absolute
246 mode; it must be set (or cleared) in symbolic mode using \fBg+s\fR (or
247 \fBg-s\fR).
248 .SS "Symbolic Mode"
249 .LP
250 A symbolic mode command line has the following format:
251 .sp
252 .LP
253 \fBchmod\fR [\fIoptions\fR] \fIsymbolic-mode-list\fR \fIfile\fR ...
254 .sp
255 .LP
256 where \fIsymbolic-mode-list\fR is a comma-separated list (with no intervening
257 white space) of symbolic mode expressions of the form:
258 .sp
259 .LP
260 [\fBwho\fR] \fIoperator\fR [\fIpermissions\fR]
261 .sp
262 .LP
263 Operations are performed in the order given. Multiple \fIpermissions\fR letters
264 following a single operator cause the corresponding operations to be performed
265 simultaneously.
266 .sp
267 .ne 2
268 .na
269 \fB\fBwho\fR\fR
270 .ad
271 .RS 14n
272 zero or more of the characters \fBu\fR, \fBg\fR, \fBo\fR, and \fBa\fR
273 specifying whose permissions are to be changed or assigned:
274 .sp
275 .ne 2
276 .na
277 \fB\fBu\fR\fR
278 .ad
279 .RS 5n
280 user's permissions
281 .RE
283 .sp
284 .ne 2
285 .na
286 \fB\fBg\fR\fR
287 .ad
288 .RS 5n
289 group's permissions
290 .RE
292 .sp
293 .ne 2
294 .na
295 \fB\fBo\fR\fR
296 .ad
297 .RS 5n
298 others' permissions
299 .RE
301 .sp
302 .ne 2
303 .na
304 \fB\fBa\fR\fR
305 .ad
306 .RS 5n
307 all permissions (user, group, and other)
308 .RE
310 If \fBwho\fR is omitted, it defaults to \fBa\fR, but the setting of the file
311 mode creation mask (see \fBumask\fR in \fBsh\fR(1) or \fBcsh\fR(1) for more
312 information) is taken into account. When \fBwho\fR is omitted, \fBchmod\fR does
313 not override the restrictions of your user mask.
314 .RE
316 .sp
317 .ne 2
318 .na
319 \fB\fIoperator\fR\fR
320 .ad
321 .RS 14n
322 either \fB+\fR, \fB\(mi\fR, or \fB=\fR, signifying how permissions are to be
323 changed:
324 .sp
325 .ne 2
326 .na
327 \fB\fB+\fR\fR
328 .ad
329 .RS 8n
330 Add permissions.
331 .sp
332 If \fIpermissions\fR are omitted, nothing is added.
333 .sp
334 If \fBwho\fR is omitted, add the file mode bits represented by
335 \fIpermissions\fR, \fIexcept\fR for the those with corresponding bits in the
336 file mode creation mask.
337 .sp
338 If \fBwho\fR is present, add the file mode bits represented by the
339 \fIpermissions\fR.
340 .RE
342 .sp
343 .ne 2
344 .na
345 \fB\fB\(mi\fR\fR
346 .ad
347 .RS 8n
348 Take away permissions.
349 .sp
350 If \fIpermissions\fR are omitted, do nothing.
351 .sp
352 If \fBwho\fR is omitted, clear the file mode bits represented by
353 \fIpermissions\fR, \fIexcept\fR for those with corresponding bits in the file
354 mode creation mask.
355 .sp
356 If \fBwho\fR is present, clear the file mode bits represented by
357 \fIpermissions\fR.
358 .RE
360 .sp
361 .ne 2
362 .na
363 \fB\fB=\fR\fR
364 .ad
365 .RS 8n
366 Assign permissions absolutely.
367 .sp
368 If \fBwho\fR is omitted, clear all file mode bits; if \fBwho\fR is present,
369 clear the file mode bits represented by \fBwho\fR.
370 .sp
371 If \fIpermissions\fR are omitted, do nothing else.
372 .sp
373 If \fBwho\fR is omitted, add the file mode bits represented by
374 \fIpermissions\fR, \fIexcept\fR for the those with corresponding bits in the
375 file mode creation mask.
376 .sp
377 If \fBwho\fR is present, add the file mode bits represented by
378 \fIpermissions\fR.
379 .RE
381 Unlike other symbolic operations, \fB=\fR has an absolute effect in that it
382 resets all other bits represented by \fBwho\fR. Omitting \fIpermissions\fR is
383 useful only with \fB=\fR to take away all permissions.
384 .RE
386 .sp
387 .ne 2
388 .na
389 \fB\fIpermission\fR\fR
390 .ad
391 .RS 14n
392 any compatible combination of the following letters:
393 .sp
394 .ne 2
395 .na
396 \fB\fBl\fR\fR
397 .ad
398 .RS 9n
399 mandatory locking
400 .RE
402 .sp
403 .ne 2
404 .na
405 \fB\fBr\fR\fR
406 .ad
407 .RS 9n
408 read permission
409 .RE
411 .sp
412 .ne 2
413 .na
414 \fB\fBs\fR\fR
415 .ad
416 .RS 9n
417 user or group set-ID
418 .RE
420 .sp
421 .ne 2
422 .na
423 \fB\fBt\fR\fR
424 .ad
425 .RS 9n
426 sticky bit
427 .RE
429 .sp
430 .ne 2
431 .na
432 \fB\fBw\fR\fR
433 .ad
434 .RS 9n
435 write permission
436 .RE
438 .sp
439 .ne 2
440 .na
441 \fB\fBx\fR\fR
442 .ad
443 .RS 9n
444 execute permission
445 .RE
447 .sp
448 .ne 2
449 .na
450 \fB\fBX\fR\fR
451 .ad
452 .RS 9n
453 execute permission if the file is a directory or if there is execute permission
454 for one of the other user classes
455 .RE
457 .sp
458 .ne 2
459 .na
460 \fB\fBu\fR,\fBg\fR,\fBo\fR\fR
461 .ad
462 .RS 9n
463 indicate that \fIpermission\fR is to be taken from the current user, group or
464 other mode respectively.
465 .RE
467 Permissions to a file can vary depending on your user identification number
468 (UID) or group identification number (GID). Permissions are described in three
469 sequences each having three characters:
470 .sp
472 .sp
473 .TS
474 l l l
475 l l l .
476 User Group Other
477 rwx rwx rwx
478 .TE
480 This example (user, group, and others all have permission to read, write, and
481 execute a given file) demonstrates two categories for granting permissions: the
482 access class and the permissions themselves.
483 .sp
484 The letter \fBs\fR is only meaningful with \fBu\fR or \fBg\fR, and \fBt\fR only
485 works with \fBu\fR.
486 .sp
487 Mandatory file and record locking (\fBl\fR) refers to a file's ability to have
488 its reading or writing permissions locked while a program is accessing that
489 file.
490 .sp
491 In a directory which has the set-group-ID bit set (reflected as either
492 \fB-----s---\fR or \fB-----l---\fR in the output of \fB\&'ls -ld'\fR), files
493 and subdirectories are created with the group-ID of the parent directory\(emnot
494 that of current process.
495 .sp
496 It is not possible to permit group execution and enable a file to be locked on
497 execution at the same time. In addition, it is not possible to turn on the
498 set-group-ID bit and enable a file to be locked on execution at the same time.
499 The following examples, therefore, are invalid and elicit error messages:
500 .sp
501 .in +2
502 .nf
503 chmod g+x,+l \fIfile\fR
504 chmod g+s,+l \fIfile\fR
505 .fi
506 .in -2
507 .sp
509 Only the owner of a file or directory (or the super-user) can change that
510 file's or directory's mode. Only the super-user can set the sticky bit on a
511 non-directory file. If you are not super-user, \fBchmod\fR masks the sticky-bit
512 but does not return an error. In order to turn on a file's set-group-ID bit,
513 your own group ID must correspond to the file's and group execution must be
514 set.
515 .RE
517 .SS "ACL Operation"
518 .LP
519 An ACL Operation command line has the following format:
520 .sp
521 .in +2
522 .nf
523 chmod [\fIoptions\fR] A[\fInumber\fR]- \fIfile\fR ...
524 chmod [\fIoptions\fR] A-\fIacl_specification\fR \fIfile\fR ...
525 chmod [\fIoptions\fR] A[\fIindex\fR]{+|=}\fIacl_specification\fR \fIfile\fR ...
526 .fi
527 .in -2
528 .sp
530 .sp
531 .LP
532 Where \fIacl_specification\fR is a comma-separated list (with no intervening
533 white space) of an ACL specification of the form:
534 .sp
535 .ne 2
536 .na
537 \fB\fBA[\fIindex\fR]+\fIacl_specification\fR\fR\fR
538 .ad
539 .RS 30n
540 Prepends the access control entries (ACE) specified in \fIacl_specification\fR
541 to the beginning of the file's ACL. Depending on the file system, the ACL can
542 be reordered when applied to the file. If "optional" number is specified then
543 new ACEs are inserted before specified number.
544 .RE
546 .sp
547 .ne 2
548 .na
549 \fB\fBA-\fR\fR
550 .ad
551 .RS 30n
552 Removes all ACEs for current ACL on file and replaces current ACL with new ACL
553 that represents only the current mode of the file.
554 .RE
556 .sp
557 .ne 2
558 .na
559 \fB\fBA\fIindex\fR\fR-\fR
560 .ad
561 .RS 30n
562 Removes ACE specified by \fIindex\fR number.
563 .RE
565 .sp
566 .ne 2
567 .na
568 \fB\fBA-\fIacl_specification\fR\fR\fR
569 .ad
570 .br
571 .na
572 \fB\fR
573 .ad
574 .RS 30n
575 Removes ACEs specified by \fIacl_specification\fR, if they exist in current
576 file's ACL.
577 .RE
579 .sp
580 .ne 2
581 .na
582 \fB\fBA=\fIacl_specification\fR\fR\fR
583 .ad
584 .RS 30n
585 Replaces a files entire ACL with \fIacl_specification\fR.
586 .RE
588 .sp
589 .ne 2
590 .na
591 \fB\fBA[\fIindex\fR]=\fIacl_specification\fR\fR\fR
592 .ad
593 .RS 30n
594 Replaces ACEs starting at a specific index number in the current ACL on the
595 file. If multiple ACEs are specified, then each subsequent ACE in
596 \fIacl_specification\fR replaces the corresponding ACE in the current ACL.
597 .RE
599 .sp
600 .LP
601 \fBPOSIX-draft ACL Specification (as supported by UFS)\fR
602 .sp
603 .LP
604 POSIX-draft ACLs (as supported by UFS) are specified as colon (\fB:\fR)
605 separated fields of the following.
606 .sp
607 .ne 2
608 .na
609 \fBuser::perms\fR
610 .ad
611 .sp .6
612 .RS 4n
613 File owner permissions.
614 .RE
616 .sp
617 .ne 2
618 .na
619 \fBuser:\fIusername\fR:perms\fR
620 .ad
621 .sp .6
622 .RS 4n
623 Permissions for a specific user.
624 .RE
626 .sp
627 .ne 2
628 .na
629 \fBgroup::perms\fR
630 .ad
631 .sp .6
632 .RS 4n
633 File group owner permissions.
634 .RE
636 .sp
637 .ne 2
638 .na
639 \fBgroup:\fIgroupname:\fRperms\fR
640 .ad
641 .sp .6
642 .RS 4n
643 Permissions for a specific group.
644 .RE
646 .sp
647 .ne 2
648 .na
649 \fBother::perms\fR
650 .ad
651 .sp .6
652 .RS 4n
653 Permissions for user other than the file owner or members of file group owner.
654 .RE
656 .sp
657 .ne 2
658 .na
659 \fBmask:perms\fR
660 .ad
661 .sp .6
662 .RS 4n
663 The ACL mask. The mask entry specifies the maximum permissions allowed for user
664 (other than that the owner) and for groups.
665 .RE
667 .sp
668 .ne 2
669 .na
670 \fBdefault:user::perms\fR
671 .ad
672 .sp .6
673 .RS 4n
674 Default file owner permissions.
675 .RE
677 .sp
678 .ne 2
679 .na
680 \fBdefault:user:\fIusername\fR:perms\fR
681 .ad
682 .sp .6
683 .RS 4n
684 Default permissions for a specific user.
685 .RE
687 .sp
688 .ne 2
689 .na
690 \fBdefault:group::perms\fR
691 .ad
692 .sp .6
693 .RS 4n
694 Default file group owner permissions.
695 .RE
697 .sp
698 .ne 2
699 .na
700 \fBdefault:group:\fIgroupname\fR:perms\fR
701 .ad
702 .sp .6
703 .RS 4n
704 Default permissions for a specific group.
705 .RE
707 .sp
708 .ne 2
709 .na
710 \fBdefault:other:perms\fR
711 .ad
712 .sp .6
713 .RS 4n
714 Default permissions for user other than the file owner or members of the file
715 group owner.
716 .RE
718 .sp
719 .ne 2
720 .na
721 \fBdefault:mask:perms\fR
722 .ad
723 .sp .6
724 .RS 4n
725 Default ACL mask.
726 .RE
728 .sp
729 .LP
730 The above specification allows for ACLs to be specified such as:
731 .sp
732 .in +2
733 .nf
734 user:tom:rw-,mask:rwx,group:staff:r-x
735 .fi
736 .in -2
737 .sp
739 .sp
740 .LP
741 \fBNFSv4 ACL Specification (as supported by NFSv4 and ZFS)\fR
742 .sp
743 .LP
744 NFSv4 ACLs provide richer ACL semantics. They provide both allow and deny
745 entries, finer grained permissions, and enhanced inheritance control.
746 .sp
747 .LP
748 NFSv4 ACLs are specified as colon (\fB:\fR) separated fields of the following.
749 .sp
750 .ne 2
751 .na
752 \fBowner@:<perms>[:inheritance flags]:<allow|deny>\fR
753 .ad
754 .sp .6
755 .RS 4n
756 Permissions for file owner.
757 .RE
759 .sp
760 .ne 2
761 .na
762 \fBgroup@:<perms>[:inheritance flags]:<allow|deny>\fR
763 .ad
764 .sp .6
765 .RS 4n
766 Permissions for file group owner.
767 .RE
769 .sp
770 .ne 2
771 .na
772 \fBeveryone@:<perms>[:inheritance flags]:<allow|deny>\fR
773 .ad
774 .sp .6
775 .RS 4n
776 Permissions for everyone, including file owner and group owner.
777 .RE
779 .sp
780 .ne 2
781 .na
782 \fBuser:<username>:<perms>[:inheritance flags]:<allow|deny>\fR
783 .ad
784 .sp .6
785 .RS 4n
786 Permissions for a specific user.
787 .RE
789 .sp
790 .ne 2
791 .na
792 \fBusersid:<sid string>:<perms>[:inheritance flags]:<allow|deny>\fR
793 .ad
794 .sp .6
795 .RS 4n
796 Permissions for a specific user, but user is specified by SID.
797 .RE
799 .sp
800 .ne 2
801 .na
802 \fBgroup:<groupname>:<perms>[:inheritance flags]:<allow|deny>\fR
803 .ad
804 .sp .6
805 .RS 4n
806 Permissions for a specific group.
807 .RE
809 .sp
810 .ne 2
811 .na
812 \fBgroupsid:<sid string>:<perms>[:inheritance flags]:<allow|deny>\fR
813 .ad
814 .sp .6
815 .RS 4n
816 Permissions for a specific group, but group is specified by SID.
817 .RE
819 .sp
820 .ne 2
821 .na
822 \fBsid:<sid string>:<perms>[:inheritance flags]:<allow|deny>\fR
823 .ad
824 .sp .6
825 .RS 4n
826 Permissions for a specific SID, but it doesn't matter if it is a user or a
827 group.
828 .RE
830 .sp
831 .LP
832 Permissions can be specified in three different \fBchmod\fR ACL formats:
833 verbose, compact, or positional. The verbose format uses words to indicate that
834 the permissions are separated with a forward slash (\fB/\fR) character. Compact
835 format uses the permission letters and positional format uses the permission
836 letters or the hyphen (\fB-\fR) to identify no permissions.
837 .sp
838 .LP
839 The permissions for verbose mode and their abbreviated form in parentheses for
840 compact and positional mode are described as follows:
841 .sp
842 .ne 2
843 .na
844 \fBread_data (\fBr\fR)\fR
845 .ad
846 .RS 24n
847 Permission to read the data of a file.
848 .RE
850 .sp
851 .ne 2
852 .na
853 \fBlist_directory (\fBr\fR)\fR
854 .ad
855 .RS 24n
856 Permission to list the contents of a directory.
857 .RE
859 .sp
860 .ne 2
861 .na
862 \fBwrite_data (\fBw\fR)\fR
863 .ad
864 .RS 24n
865 Permission to modify a file's data. anywhere in the file's offset range.
866 .RE
868 .sp
869 .ne 2
870 .na
871 \fBadd_file (\fBw\fR)\fR
872 .ad
873 .RS 24n
874 Permission to add a new file to a directory.
875 .RE
877 .sp
878 .ne 2
879 .na
880 \fBappend_data (\fBp\fR)\fR
881 .ad
882 .RS 24n
883 The ability to modify a file's data, but only starting at EOF.
884 .sp
885 Currently, this permission is not supported.
886 .RE
888 .sp
889 .ne 2
890 .na
891 \fBadd_subdirectory (\fBp\fR)\fR
892 .ad
893 .RS 24n
894 Permission to create a subdirectory to a directory.
895 .RE
897 .sp
898 .ne 2
899 .na
900 \fBread_xattr (\fBR\fR)\fR
901 .ad
902 .RS 24n
903 Ability to read the extended attributes of a file.
904 .RE
906 .sp
907 .ne 2
908 .na
909 \fBwrite_xattr (\fBW\fR)\fR
910 .ad
911 .RS 24n
912 Ability to create extended attributes or write to the extended attribute
913 directory.
914 .RE
916 .sp
917 .ne 2
918 .na
919 \fBexecute (\fBx\fR)\fR
920 .ad
921 .RS 24n
922 Permission to execute a file.
923 .RE
925 .sp
926 .ne 2
927 .na
928 \fBread_attributes (\fBa\fR)\fR
929 .ad
930 .RS 24n
931 The ability to read basic attributes (non-ACLs) of a file.
932 .RE
934 .sp
935 .ne 2
936 .na
937 \fBwrite_attributes (\fBA\fR)\fR
938 .ad
939 .RS 24n
940 Permission to change the times associated with a file or directory to an
941 arbitrary value.
942 .RE
944 .sp
945 .ne 2
946 .na
947 \fBdelete (\fBd\fR)\fR
948 .ad
949 .RS 24n
950 Permission to delete a file.
951 .RE
953 .sp
954 .ne 2
955 .na
956 \fBdelete_child (\fBD\fR)\fR
957 .ad
958 .RS 24n
959 Permission to delete a file within a directory.
960 .RE
962 .sp
963 .ne 2
964 .na
965 \fBread_acl (\fBc\fR)\fR
966 .ad
967 .RS 24n
968 Permission to read the ACL of a file.
969 .RE
971 .sp
972 .ne 2
973 .na
974 \fBwrite_acl (\fBC\fR)\fR
975 .ad
976 .RS 24n
977 Permission to write the ACL of a file.
978 .RE
980 .sp
981 .ne 2
982 .na
983 \fBwrite_owner (\fBo\fR)\fR
984 .ad
985 .RS 24n
986 Permission to change the owner of a file.
987 .RE
989 .sp
990 .ne 2
991 .na
992 \fBsynchronize (\fBs\fR)\fR
993 .ad
994 .RS 24n
995 Permission to access file locally at server with synchronize reads and writes.
996 .sp
997 Currently, this permission is not supported.
998 .RE
1000 .sp
1001 .LP
1002 Using the compact ACL format, permissions are specified by using 14 unique
1003 letters to indicate permissions.
1004 .sp
1005 .LP
1006 Using the positional ACL format, permissions are specified as positional
1007 arguments similar to the \fBls\fR \fB-V\fR format. The hyphen (\fB-\fR), which
1008 indicates that no permission is granted at that position, can be omitted and
1009 only the required letters have to be specified.
1010 .sp
1011 .LP
1012 The letters above are listed in the order they would be specified in positional
1013 notation.
1014 .sp
1015 .LP
1016 Permissions can be specified with these letters in the following way:
1017 .sp
1018 .in +2
1019 .nf
1020 rwx--D--------
1021 .fi
1022 .in -2
1023 .sp
1025 .sp
1026 .LP
1027 The hyphens can be removed to compact the string as follows:
1028 .sp
1029 .in +2
1030 .nf
1031 rwxD
1032 .fi
1033 .in -2
1034 .sp
1036 .sp
1037 .LP
1038 Several special permission sets or aliases are also supported. The following
1039 permission sets are used the same way that verbose permissions are specified.
1040 .sp
1041 .ne 2
1042 .na
1043 \fB\fBfull_set\fR\fR
1044 .ad
1045 .RS 14n
1046 All permissions.
1047 .RE
1049 .sp
1050 .ne 2
1051 .na
1052 \fB\fBmodify_set\fR\fR
1053 .ad
1054 .RS 14n
1055 All permissions except \fBwrite_acl\fR and \fBwrite_owner\fR.
1056 .RE
1058 .sp
1059 .ne 2
1060 .na
1061 \fB\fBread_set\fR\fR
1062 .ad
1063 .RS 14n
1064 \fBread_data, read_acl, read_attributes,\fR and \fBread_xattr\fR.
1065 .RE
1067 .sp
1068 .ne 2
1069 .na
1070 \fB\fBwrite_set\fR\fR
1071 .ad
1072 .RS 14n
1073 \fBwrite_data, append_data, write_attributes\fR, and \fBwrite_xattr\fR
1074 .RE
1076 .sp
1077 .LP
1078 The optional inheritance flags can be specified in the three formats. The first
1079 format uses words to indicate the various inheritance flags separated with a
1080 forward slash (\fB/\fR) character.
1081 .sp
1082 .ne 2
1083 .na
1084 \fBfile_inherit (\fBf\fR)\fR
1085 .ad
1086 .RS 20n
1087 Inherit to all newly created files.
1088 .RE
1090 .sp
1091 .ne 2
1092 .na
1093 \fBdir_inherit (\fBd\fR)\fR
1094 .ad
1095 .RS 20n
1096 Inherit to all newly created directories.
1097 .RE
1099 .sp
1100 .ne 2
1101 .na
1102 \fBinherit_only (\fBi\fR)\fR
1103 .ad
1104 .RS 20n
1105 When placed on a directory, do not apply to the directory, only to newly
1106 created files and directories. This flag requires that either
1107 \fBfile_inherit\fR and or \fBdir_inherit\fR is also specified.
1108 .RE
1110 .sp
1111 .ne 2
1112 .na
1113 \fBno_propagate (\fBn\fR)\fR
1114 .ad
1115 .RS 20n
1116 Indicates that ACL entries should be inherited to objects in a directory, but
1117 inheritance should stop after descending one level. This flag is dependent upon
1118 either \fBfile_inherit\fR and or \fBdir_inherit\fR also being specified.
1119 .RE
1121 .sp
1122 .ne 2
1123 .na
1124 \fBsuccessful_access (\fBS\fR)\fR
1125 .ad
1126 .RS 20n
1127 Indicates whether an alarm or audit record should be initiated upon successful
1128 accesses. Used with audit/alarm ACE types.
1129 .RE
1131 .sp
1132 .ne 2
1133 .na
1134 \fBfailed_access (\fBF\fR)\fR
1135 .ad
1136 .RS 20n
1137 Indicates whether an alarm or audit record should be initiated when access
1138 fails. Used with audit/alarm ACE types.
1139 .RE
1141 .sp
1142 .ne 2
1143 .na
1144 \fBinherited (\fBI\fR)\fR
1145 .ad
1146 .RS 20n
1147 ACE was inherited.
1148 .RE
1150 .sp
1151 .LP
1152 The inheritance flags listed can also be specified in the compact format or as
1153 positional arguments similar to the \fBls\fR \fB-V\fR format. A hyphen
1154 character indicates that the inheritance flag at that position is not specified
1155 in the positional ACL format.
1156 .sp
1157 .LP
1158 The inheritance flags can be specified with these letters in any of the
1159 following equivalent ways.
1160 .sp
1161 .in +2
1162 .nf
1163 file_inherit/dir_inherit/no_propagate
1164 .fi
1165 .in -2
1166 .sp
1168 .sp
1169 .in +2
1170 .nf
1171 fd-n---
1172 .fi
1173 .in -2
1174 .sp
1176 .sp
1177 .in +2
1178 .nf
1179 fdn
1180 .fi
1181 .in -2
1182 .sp
1184 .sp
1185 .LP
1186 With this inheritance model, an ACL entry can be specified such as:
1187 .sp
1188 .in +2
1189 .nf
1190 user:tom:read_data/write_data/read_attributes:file_inherit:allow
1191 user:fred:read_data:file_inherit/dir_inherit:deny
1192 user:bob:read_data:allow
1193 .fi
1194 .in -2
1195 .sp
1197 .SS "Attribute Operation"
1198 .LP
1199 An attribute operation command line has the following format:
1200 .sp
1201 .in +2
1202 .nf
1203 chmod [\fIoptions\fR] \fIattribute_specification_list\fR \fIfile\fR ...
1204 .fi
1205 .in -2
1206 .sp
1208 .sp
1209 .LP
1210 where \fIattribute_specification_list\fR is the character \fBS\fR followed by a
1211 comma-separated list of one or more \fIattribute_specifications\fR. Each
1212 \fIattribute_specification\fR is of the form:
1213 .sp
1214 .in +2
1215 .nf
1216 [\fIoperator\fR]\fIattribute_specifier\fR
1217 .fi
1218 .in -2
1219 .sp
1221 .sp
1222 .LP
1223 An \fIoperator\fR is one of the following:
1224 .sp
1225 .ne 2
1226 .na
1227 \fB\fB+\fR\fR
1228 .ad
1229 .RS 5n
1230 Each attribute specified by the associated \fIattribute_specifier\fR is
1231 adjusted to match the value specified by the \fIattribute_specifier\fR.
1232 .RE
1234 .sp
1235 .ne 2
1236 .na
1237 \fB\fB-\fR\fR
1238 .ad
1239 .RS 5n
1240 Each attribute specified by the associated \fIattribute_specifier\fR is
1241 adjusted to match the inverse of the value specified by the
1242 \fIattribute_specifier\fR.
1243 .RE
1245 .sp
1246 .ne 2
1247 .na
1248 \fB\fB=\fR\fR
1249 .ad
1250 .RS 5n
1251 Each attribute specified by the associated \fIattribute_specifier\fR is
1252 adjusted to match the value specified by the \fIattribute_specifier\fR. Any
1253 boolean read-write extended system attributes associated with the current file
1254 that are not specified by \fIattribute_specifier\fR is cleared.
1255 .RE
1257 .sp
1258 .LP
1259 If an \fIoperator\fR is not specified in an \fIattribute_specification\fR,
1260 \fBchmod\fR behaves as if \fB+\fR had been specified.
1261 .sp
1262 .LP
1263 An \fIattribute_specifier\fR takes one of the following forms:
1264 .sp
1265 .ne 2
1266 .na
1267 \fB\fBa\fR\fR
1268 .ad
1269 .sp .6
1270 .RS 4n
1271 Set all boolean read-write extended system attributes associated with the
1272 current file.
1273 .RE
1275 .sp
1276 .ne 2
1277 .na
1278 \fB\fBc[\fIcompact_attribute_list\fR]\fR\fR
1279 .ad
1280 .br
1281 .na
1282 \fB\fBc'{'\fIcompact_attribute_list\fR'}'\fR\fR
1283 .ad
1284 .sp .6
1285 .RS 4n
1286 Set each boolean read-write extended system attribute identified by
1287 \fIcompact_attribute_list\fR.
1288 .RE
1290 .sp
1291 .ne 2
1292 .na
1293 \fB\fBv[\fIverbose_attribute_setting\fR]\fR\fR
1294 .ad
1295 .br
1296 .na
1297 \fB\fBv['{'\fIverbose_attribute_setting_list\fR'}']\fR\fR
1298 .ad
1299 .sp .6
1300 .RS 4n
1301 Set each boolean read-write extended system attribute identified by
1302 \fIverbose_attribute_setting\fR.
1303 .RE
1305 .sp
1306 .LP
1307 A \fIcompact_attribute_list\fR is a list of zero or more adjacent attribute
1308 abbreviation characters from list of \fBAttribute Names and Abbreviation
1309 Characters\fR later in this section. An arbitrary number of hyphen (\fB-\fR)
1310 characters can be included in a \fIcompact_attribute_list\fR. These are
1311 ignored.
1312 .sp
1313 .LP
1314 A \fIverbose_attribute_setting\fR is an attribute name from the list of
1315 \fBAttribute Names and Abbreviation Characters\fR later in this section,
1316 optionally, immediately preceded by \fBno\fR. If the attribute name is used
1317 without \fBno\fR, the attribute is set; otherwise the attribute is cleared.
1318 .sp
1319 .LP
1320 A \fIverbose_attribute_setting_list\fR is zero or more comma-separated
1321 \fIverbose_attribute_setting\fRs.
1322 .sp
1323 .LP
1324 Multiple operations specified for a file are accumulated and are all set for a
1325 file operand as a single attribute setting operation. If an attribute is
1326 specified more than once in an \fIattribute_specification_list\fR, the last
1327 specified operation is applied.
1328 .sp
1329 .LP
1330 The following is a list of \fBAttribute Names and Abbreviation Characters\fR:
1331 .sp
1332 .ne 2
1333 .na
1334 \fB\fBAttribute Name\fR\fR
1335 .ad
1336 .RS 18n
1337 \fBAbbreviation Character\fR
1338 .RE
1340 .sp
1341 .ne 2
1342 .na
1343 \fB\fBhidden\fR\fR
1344 .ad
1345 .RS 18n
1346 \fBH\fR
1347 .RE
1349 .sp
1350 .ne 2
1351 .na
1352 \fB\fBsystem\fR\fR
1353 .ad
1354 .RS 18n
1355 \fBS\fR
1356 .RE
1358 .sp
1359 .ne 2
1360 .na
1361 \fB\fBreadonly\fR\fR
1362 .ad
1363 .RS 18n
1364 \fBR\fR
1365 .RE
1367 .sp
1368 .ne 2
1369 .na
1370 \fB\fBarchive\fR\fR
1371 .ad
1372 .RS 18n
1373 \fBA\fR
1374 .RE
1376 .sp
1377 .ne 2
1378 .na
1379 \fB\fBnounlink\fR\fR
1380 .ad
1381 .RS 18n
1382 \fBu\fR
1383 .RE
1385 .sp
1386 .ne 2
1387 .na
1388 \fB\fBimmutable\fR\fR
1389 .ad
1390 .RS 18n
1391 \fBi\fR
1392 .RE
1394 .sp
1395 .ne 2
1396 .na
1397 \fB\fBappendonly\fR\fR
1398 .ad
1399 .RS 18n
1400 \fBa\fR
1401 .RE
1403 .sp
1404 .ne 2
1405 .na
1406 \fB\fBnodump\fR\fR
1407 .ad
1408 .RS 18n
1409 \fBd\fR
1410 .RE
1412 .sp
1413 .ne 2
1414 .na
1415 \fB\fBav_quarantined\fR\fR
1416 .ad
1417 .RS 18n
1418 \fBq\fR
1419 .RE
1421 .sp
1422 .ne 2
1423 .na
1424 \fB\fBav_modified\fR\fR
1425 .ad
1426 .RS 18n
1427 \fBm\fR
1428 .RE
1430 .sp
1431 .ne 2
1432 .na
1433 \fB\fBoffline\fR\fR
1434 .ad
1435 .RS 18n
1436 \fBO\fR
1437 .RE
1439 .sp
1440 .ne 2
1441 .na
1442 \fB\fBsparse\fR\fR
1443 .ad
1444 .RS 18n
1445 \fBs\fR
1446 .RE
1448 .SH OPTIONS
1449 .LP
1450 The following options are supported:
1451 .sp
1452 .ne 2
1453 .na
1454 \fB\fB-f\fR\fR
1455 .ad
1456 .RS 22n
1457 Force. \fBchmod\fR does not complain if it fails to change the mode of a file.
1458 .RE
1460 .sp
1461 .ne 2
1462 .na
1463 \fB\fB-R\fR\fR
1464 .ad
1465 .RS 22n
1466 Recursively descend through directory arguments, setting the mode for each
1467 file. When symbolic links are encountered, the mode of the target file is
1468 changed, but no recursion takes place.
1469 .RE
1471 .sp
1472 .ne 2
1473 .na
1474 \fB\fB-@\fR \fInamed_attribute\fR\fR
1475 .ad
1476 .RS 22n
1477 Perform the attribute operation on the named extended attribute file of each
1478 file operand instead of the file operand itself. If multiple \fB-@\fR
1479 operations are supplied, the attribute specification mode is applied to each of
1480 the named attribute files.
1481 .sp
1482 A named attribute of \fB*\fR carries meaning to \fBchmod\fR, and is considered
1483 to mean all extended attribute files associated with a file operand. This does
1484 not refer to the special files \fB\&.\fR and \fB\&..\fR.
1485 .sp
1486 A named attribute of \fB\&..\fR carries special meaning to \fBchmod\fR, and is
1487 considered to mean the file operand itself. This allows \fBchmod\fR, in a
1488 single call, to apply the attribute specification mode to the specified named
1489 attribute file of the file operand and the file operand itself.
1490 .RE
1492 .SH OPERANDS
1493 .LP
1494 The following operands are supported:
1495 .sp
1496 .ne 2
1497 .na
1498 \fB\fIabsolute-mode\fR\fR
1499 .ad
1500 .br
1501 .na
1502 \fB\fIsymbolic-mode-list\fR\fR
1503 .ad
1504 .sp .6
1505 .RS 4n
1506 Represents the change to be made to the file mode bits of each file named by
1507 one of the \fIfile\fR operands. See \fBAbsolute Mode\fR and \fBSymbolic Mode\fR
1508 in the \fBDESCRIPTION\fR section of this manual page for more information.
1509 .RE
1511 .sp
1512 .ne 2
1513 .na
1514 \fB\fIacl_operation\fR\fR
1515 .ad
1516 .sp .6
1517 .RS 4n
1518 Represents the modification to be performed on the file's ACL. See \fBACL
1519 Operation\fR in the \fBDESCRIPTION\fR section for more information.
1520 .sp
1521 \fIacl_operation\fR is one of the following:
1522 .sp
1523 .in +2
1524 .nf
1525 \fBA[\fR\fInumber\fR\fB] -\fR
1526 \fBA-\fR\fIacl_specification\fR
1527 \fBA[\fR\fIindex\fR\fB]{+|=}\fR\fBacl_specification\fR
1528 .fi
1529 .in -2
1530 .sp
1532 .RE
1534 .sp
1535 .ne 2
1536 .na
1537 \fB\fIattribute_specification_list\fR\fR
1538 .ad
1539 .sp .6
1540 .RS 4n
1541 Represents the modification to performed on the file's attributes. See
1542 Attribute Operation in the \fBDESCRIPTION\fR section of this manual page for
1543 more information.
1544 .RE
1546 .sp
1547 .ne 2
1548 .na
1549 \fB\fIfile\fR\fR
1550 .ad
1551 .sp .6
1552 .RS 4n
1553 A path name of a file whose file mode bits are to be modified.
1554 .RE
1556 .SH EXAMPLES
1557 .LP
1558 \fBExample 1 \fRDenying \fBexecute\fR Permission
1559 .sp
1560 .LP
1561 The following example denies execute permission to everyone:
1563 .sp
1564 .in +2
1565 .nf
1566 % chmod a-x \fIfile\fR
1567 .fi
1568 .in -2
1569 .sp
1571 .LP
1572 \fBExample 2 \fRAllowing \fBread-only\fR Permission
1573 .sp
1574 .LP
1575 The following example allows only read permission to everyone:
1577 .sp
1578 .in +2
1579 .nf
1580 % chmod 444 \fIfile\fR
1581 .fi
1582 .in -2
1583 .sp
1585 .LP
1586 \fBExample 3 \fRMaking a File \fBreadable\fR and \fBwritable\fR
1587 .sp
1588 .LP
1589 The following example makes a file readable and writable by the group and
1590 others:
1592 .sp
1593 .in +2
1594 .nf
1595 % chmod go+rw \fIfile\fR
1596 % chmod 066 \fIfile\fR
1597 .fi
1598 .in -2
1599 .sp
1601 .LP
1602 \fBExample 4 \fRLocking a File From Access
1603 .sp
1604 .LP
1605 The following example locks a file from access:
1607 .sp
1608 .in +2
1609 .nf
1610 $ chmod +l \fIfile\fR
1611 .fi
1612 .in -2
1613 .sp
1615 .LP
1616 \fBExample 5 \fRGranting \fBread\fR, \fBwrite\fR, \fBexecute\fR, and \fBset
1617 group-ID\fR Permission on a File
1618 .sp
1619 .LP
1620 The following example grants everyone read, write, and execute permissions on
1621 the file, and turns on the set group-ID:
1623 .sp
1624 .in +2
1625 .nf
1626 $ chmod a=rwx,g+s \fIfile\fR
1627 $ chmod 2777 \fIfile\fR
1628 .fi
1629 .in -2
1630 .sp
1632 .LP
1633 \fBExample 6 \fRPrepending a New ACL Entry on a ZFS File
1634 .sp
1635 .LP
1636 The following example prepends a new ACL entry on a ZFS file.
1638 .sp
1639 .LP
1640 First, display the current ACL:
1642 .sp
1643 .in +2
1644 .nf
1645 $ ls -v file.3
1646 -rw-r--r-- 1 marks staff 0 Oct 9 15:49 file.3
1647 0:owner@:execute:deny
1648 1:owner@:read_data/write_data/append_data/write_xattr/
1649 write_attributes/write_acl/write_owner:allow
1650 2:group@:write_data/append_data/execute:deny
1651 3:group@:read_data:allow
1652 4:everyone@:write_data/append_data/write_xattr/execute/
1653 write_attributes/write_acl/write_owner:deny
1654 5:everyone@:read_data/read_xattr/read_attributes/read_acl/
1655 synchronize:allow
1656 .fi
1657 .in -2
1658 .sp
1660 .sp
1661 .LP
1662 Issue the following command:
1664 .sp
1665 .in +2
1666 .nf
1667 $ chmod A+user:lp:read_data:deny file.3
1668 .fi
1669 .in -2
1670 .sp
1672 .sp
1673 .LP
1674 Display the new ACL:
1676 .sp
1677 .in +2
1678 .nf
1679 $ ls -v file.3
1680 -rw-r--r--+ 1 marks staff 0 Oct 9 15:49 file.3
1681 0:user:lp:read_data:deny
1682 1:owner@:execute:deny
1683 2:owner@:read_data/write_data/append_data/write_xattr/
1684 write_attributes/write_acl/write_owner:allow
1685 3:group@:write_data/append_data/execute:deny
1686 4:group@:read_data:allow
1687 5:everyone@:write_data/append_data/write_xattr/execute/
1688 write_attributes/write_acl/write_owner:deny
1689 6:everyone@:read_data/read_xattr/read_attributes/read_acl/
1690 synchronize:allow
1691 .fi
1692 .in -2
1693 .sp
1695 .LP
1696 \fBExample 7 \fRPrepending a New POSIX-draft ACL Entry on a UFS File
1697 .sp
1698 .LP
1699 The following example prepends a new POSIX-draft ACL entry on a UFS file.
1701 .sp
1702 .LP
1703 First, display the current ACL:
1705 .sp
1706 .in +2
1707 .nf
1708 $ ls -v file.2
1709 -rw-r--r-- 1 marks staff 0 Oct 9 15:52 file.2
1710 0:user::rw-
1711 1:group::r-- #effective:r--
1712 2:mask:r--
1713 3:other:r--
1714 .fi
1715 .in -2
1716 .sp
1718 .sp
1719 .LP
1720 Issue the following command:
1722 .sp
1723 .in +2
1724 .nf
1725 $ chmod A+user:lp:-wx file.2
1726 .fi
1727 .in -2
1728 .sp
1730 .sp
1731 .LP
1732 Display the new ACL:
1734 .sp
1735 .in +2
1736 .nf
1737 $ ls -v file.2
1738 -rw-r--r--+ 1 marks staff 0 Oct 9 15:52 file.2
1739 0:user::rw-
1740 1:user:lp:-wx #effective:---
1741 2:group::r-- #effective:r--
1742 3:mask:r--
1743 4:other:r--
1744 .fi
1745 .in -2
1746 .sp
1748 .LP
1749 \fBExample 8 \fRInserting an ACL Entry in a Specific Position on a ZFS file
1750 .sp
1751 .LP
1752 The following example inserts an ACL entry in a specific position on a ZFS file
1753 system. It also illustrates the compact ACL format.
1755 .sp
1756 .LP
1757 First, display the ACL to pick a location to insert a new ACE.
1759 .sp
1760 .in +2
1761 .nf
1762 % ls -V file.1
1763 -rw-r--r--+ 1 root root 0 Oct 6 12:16 file.1
1764 user:lp:rw------------:-------:allow
1765 owner@:--x-----------:-------:deny
1766 owner@:rw-p---A-W-Co-:-------:allow
1767 group@:-wxp----------:-------:deny
1768 group@:r-------------:-------:allow
1769 everyone@:-wxp---A-W-Co-:-------:deny
1770 everyone@:r-----a-R-c--s:-------:allow
1771 .fi
1772 .in -2
1773 .sp
1775 .sp
1776 .LP
1777 Next, insert a new entry in location 3. This causes the entries that are
1778 currently in position 3 - 6 to be pushed down.
1780 .sp
1781 .LP
1782 Issue the following command:
1784 .sp
1785 .in +2
1786 .nf
1787 $ chmod A3+user:marks:r:deny file.1
1788 .fi
1789 .in -2
1790 .sp
1792 .sp
1793 .LP
1794 Display the new ACL:
1796 .sp
1797 .in +2
1798 .nf
1799 $ ls -V file.1
1800 -rw-r--r--+ 1 root staff 0 Feb 3 14:13 file.1
1801 user:lp:rw------------:-------:allow
1802 owner@:--x-----------:-------:deny
1803 owner@:rw-p---A-W-Co-:-------:allow
1804 user:marks:r-------------:-------:deny
1805 group@:-wxp----------:-------:deny
1806 group@:r-------------:-------:allow
1807 everyone@:-wxp---A-W-Co-:-------:deny
1808 everyone@:r-----a-R-c--s:-------:allow
1809 .fi
1810 .in -2
1811 .sp
1813 .LP
1814 \fBExample 9 \fRInserting a POSIX-draft ACL in a Specific Position on a UFS
1815 File
1816 .sp
1817 .LP
1818 The file system reorders ACLs when they are stored in the file system. The
1819 following example illustrates this behavior.
1821 .sp
1822 .in +2
1823 .nf
1824 $ ls -v file.1
1825 -rw-r--r--+ 1 root root 0 Sep 29 16:10 file.1
1826 0:user::rw-
1827 1:user:lp:rw- #effective:r--
1828 2:group::r-- #effective:r--
1829 3:mask:r--
1830 4:other:r--
1831 .fi
1832 .in -2
1833 .sp
1835 .sp
1836 .LP
1837 Now, insert an entry at index position 3. The command works, but the file
1838 system reorders the ACL.
1840 .sp
1841 .in +2
1842 .nf
1843 $ chmod A3+user:marks:rw- file.1
1844 $ ls -v file.1
1845 -rw-r--r--+ 1 root root 0 Sep 29 16:10 file.1
1846 0:user::rw-
1847 1:user:lp:rw- #effective:r--
1848 2:user:marks:rw- #effective:r--
1849 3:group::r-- #effective:r--
1850 4:mask:r--
1851 5:other:r--
1852 .fi
1853 .in -2
1854 .sp
1856 .sp
1857 .LP
1858 Rather than inserting the ACL entry in position 3 as requested, it actually
1859 ends up in position 2.
1861 .LP
1862 \fBExample 10 \fRRemoving an ACL Entry on a ZFS File
1863 .sp
1864 .LP
1865 The following example removes the \fBlp\fR entry from an ACL:
1867 .sp
1868 .in +2
1869 .nf
1870 $ ls -v file.3
1871 -rw-r--r--+ 1 marks staff 0 Oct 9 15:49 file.3
1872 0:user:lp:read_data:deny
1873 1:owner@:execute:deny
1874 2:owner@:read_data/write_data/append_data/write_xattr/
1875 write_attributes/write_acl/write_owner:allow
1876 3:group@:write_data/append_data/execute:deny
1877 4:group@:read_data:allow
1878 5:everyone@:write_data/append_data/write_xattr/execute/
1879 write_attributes/write_acl/write_owner:deny
1880 6:everyone@:read_data/read_xattr/read_attributes/read_acl/
1881 synchronize:allow
1882 .fi
1883 .in -2
1884 .sp
1886 .sp
1887 .in +2
1888 .nf
1889 $ chmod A-user:lp:read_data:deny file.3
1890 $ ls -v file.3
1891 -rw-r--r-- 1 marks staff 0 Oct 9 15:49 file.3
1892 0:owner@:execute:deny
1893 1:owner@:read_data/write_data/append_data/write_xattr/
1894 write_attributes/write_acl/write_owner:allow
1895 2:group@:write_data/append_data/execute:deny
1896 3:group@:read_data:allow
1897 4:everyone@:write_data/append_data/write_xattr/execute/
1898 write_attributes/write_acl/write_owner:deny
1899 5:everyone@:read_data/read_xattr/read_attributes/read_acl/
1900 synchronize:allow
1901 .fi
1902 .in -2
1903 .sp
1905 .LP
1906 \fBExample 11 \fRRemoving a POSIX-draft ACL on a UFS File
1907 .sp
1908 .LP
1909 The following example removes the \fBlp\fR entry from an ACL:
1911 .sp
1912 .in +2
1913 .nf
1914 $ ls -v file.2
1915 -rw-r--r--+ 1 marks staff 0 Oct 9 15:52 file.2
1916 0:user::rw-
1917 1:user:lp:-wx #effective:---
1918 2:group::r-- #effective:r--
1919 3:mask:r--
1920 4:other:r--
1921 .fi
1922 .in -2
1923 .sp
1925 .sp
1926 .in +2
1927 .nf
1928 $ chmod A-user:lp:-wx file.2
1929 $ ls -v file.2
1930 -rw-r--r-- 1 marks staff 0 Oct 9 15:52 file.2
1931 0:user::rw-
1932 1:group::r-- #effective:r--
1933 2:mask:r--
1934 3:other:r--
1935 .fi
1936 .in -2
1937 .sp
1939 .LP
1940 \fBExample 12 \fRRemoving a Specific ACL Entry by Index Number on a ZFS File
1941 .sp
1942 .LP
1943 Consider the following ACL:
1945 .sp
1946 .in +2
1947 .nf
1948 $ ls -v file
1949 0:group:staff:read_data/write_data/execute/read_acl:allow
1950 1:user:bin:read_data:deny
1951 2:user:bin:read_data:allow
1952 3:owner@:write_data/append_data:deny
1953 4:owner@:read_data/write_xattr/execute/write_attributes/write_acl
1954 /write_owner:allow
1955 5:group@:write_data/append_data:deny
1956 6:group@:read_data/execute:allow
1957 7:everyone@:write_data/append_data/write_xattr/write_attributes
1958 /write_acl/write_owner:deny
1959 8:everyone@:read_data/read_xattr/execute/read_attributes/read_acl
1960 /synchronize:allow
1961 .fi
1962 .in -2
1963 .sp
1965 .sp
1966 .LP
1967 Remove the second user entry for bin.
1969 .sp
1970 .in +2
1971 .nf
1972 $ chmod A2- file
1973 $ ls -v file
1974 0:group:staff:read_data/write_data/execute/read_acl:allow
1975 1:user:bin:read_data:deny
1976 2:owner@:write_data/append_data:deny
1977 3:owner@:read_data/write_xattr/execute/write_attributes/write_acl
1978 /write_owner:allow
1979 4:group@:write_data/append_data:deny
1980 5:group@:read_data/execute:allow
1981 6:everyone@:write_data/append_data/write_xattr/write_attributes
1982 /write_acl/write_owner:deny
1983 7:everyone@:read_data/read_xattr/execute/read_attributes/read_acl
1984 /synchronize:allow
1985 .fi
1986 .in -2
1987 .sp
1989 .LP
1990 \fBExample 13 \fRRemoving a Specific POSIX-draft ACL Entry on a UFS File
1991 .sp
1992 .LP
1993 The following example removes the lp entry by index number from the following
1994 ACL:
1996 .sp
1997 .in +2
1998 .nf
1999 $ ls -v file.1
2000 -rw-r--r--+ 1 root root 0 Sep 29 16:10 file.1
2001 0:user::rw-
2002 1:user:lp:rw- #effective:r--
2003 2:group::r-- #effective:r--
2004 3:mask:r--
2005 4:other:r--
2007 $ chmod A1- file.1
2008 $ ls -v
2009 -rw-r--r--+ 1 root root 0 Sep 29 16:10 file.1
2010 0:user::rw-
2011 1:group::r-- #effective:r--
2012 2:mask:r--
2013 3:other:r--
2014 .fi
2015 .in -2
2016 .sp
2018 .LP
2019 \fBExample 14 \fRRemoving All ACLs From a File
2020 .sp
2021 .LP
2022 The following command works with either NFSv4/ZFS or POSIX-draft ACLs.
2024 .sp
2025 .LP
2026 Consider the following ACL:
2028 .sp
2029 .in +2
2030 .nf
2031 $ ls -v file.3
2032 -rw-r--r--+ 1 marks staff 0 Oct 9 15:49 file.3
2033 0:user:lp:read_data/write_data:allow
2034 1:user:marks:read_acl:allow
2035 2:owner@:execute:deny
2036 3:owner@:read_data/write_data/append_data/write_xattr/
2037 write_attributes/write_acl/write_owner:allow
2038 4:group@:write_data/append_data/execute:deny
2039 5:group@:read_data:allow
2040 6:everyone@:write_data/append_data/write_xattr/execute/
2041 write_attributes/write_acl/write_owner:deny
2042 7:everyone@:read_data/read_xattr/read_attributes/read_acl/
2043 synchronize:allow
2044 .fi
2045 .in -2
2046 .sp
2048 .sp
2049 .LP
2050 The existing ACL is effectively removed and is replaced with an ACL that
2051 represents the permission bits of the file.
2053 .sp
2054 .in +2
2055 .nf
2056 $ chmod A- file.3
2057 $ ls -v file.3
2058 -rw-r--r-- 1 marks staff 0 Oct 9 15:49 file.3
2059 0:owner@:execute:deny
2060 1:owner@:read_data/write_data/append_data/write_xattr/
2061 write_attributes/write_acl/write_owner:allow
2062 2:group@:write_data/append_data/execute:deny
2063 3:group@:read_data:allow
2064 4:everyone@:write_data/append_data/write_xattr/execute/
2065 write_attributes/write_acl/write_owner:deny
2066 5:everyone@:read_data/read_xattr/read_attributes/read_acl/
2067 synchronize:allow
2068 .fi
2069 .in -2
2070 .sp
2072 .LP
2073 \fBExample 15 \fRReplacing an Entire ACL Entry on a ZFS File
2074 .sp
2075 .LP
2076 Use the following \fBchmod\fR syntax if you want to replace an ACL in its
2077 entirety:
2079 .sp
2080 .in +2
2081 .nf
2082 $ chmod A=owner@:read_data/write_data:allow,group@:read_data/
2083 write_data:allow,user:lp:read_data:allow file.4
2084 $ ls -v file.4
2085 -rw-rw----+ 1 marks staff 0 Oct 9 16:12 file.4
2086 0:owner@:read_data/write_data:allow
2087 1:group@:read_data/write_data:allow
2088 2:user:lp:read_data:allow
2089 .fi
2090 .in -2
2091 .sp
2093 .LP
2094 \fBExample 16 \fRReplacing an Entire POSIX-draft ACL on a UFS File
2095 .sp
2096 .LP
2097 This operation is a little more complicated. The replacement ACL needs the
2098 necessary entries to represent the file owner, file group owner, other, mask
2099 and any additional entries you wish to set.
2101 .sp
2102 .in +2
2103 .nf
2104 $ chmod A=user::rw-,group::rw-,other::---,mask:r--,
2105 user:lp:r-- file.3
2106 $ ls -v file.3
2107 -rw-r-----+ 1 root root 0 Oct 9 16:14 file.3
2108 0:user::rw-
2109 1:user:lp:r-- #effective:r--
2110 2:group::rw- #effective:r--
2111 3:mask:r--
2112 4:other:---
2113 .fi
2114 .in -2
2115 .sp
2117 .LP
2118 \fBExample 17 \fRReplacing a Specific Entry on a ZFS File
2119 .sp
2120 .LP
2121 Consider the following ACL.
2123 .sp
2124 .in +2
2125 .nf
2126 $ ls -v file.5
2127 -rw-r--r--+ 1 marks staff 0 Oct 9 16:18 file.5
2128 0:user:marks:read_data:allow
2129 1:owner@:execute:deny
2130 2:owner@:read_data/write_data/append_data/write_xattr/
2131 write_attributes/write_acl/write_owner:allow
2132 3:group@:write_data/append_data/execute:deny
2133 4:group@:read_data:allow
2134 5:everyone@:write_data/append_data/write_xattr/execute/
2135 write_attributes/write_acl/write_owner:deny
2136 6:everyone@:read_data/read_xattr/read_attributes/read_acl/
2137 synchronize:allow
2138 .fi
2139 .in -2
2140 .sp
2142 .sp
2143 .LP
2144 Now, change the allow access to a deny for user marks:
2146 .sp
2147 .in +2
2148 .nf
2149 $ chmod A0=user:marks:read_data:deny file.5
2150 $ ls -v file.5
2151 -rw-r--r--+ 1 marks staff 0 Aug 23 09:11 file.5
2152 0:user:marks:read_data:deny
2153 1:owner@:read_data/write_data/append_data/write_xattr/write_attributes
2154 /write_acl/write_owner:allow
2155 2:group@:write_data/append_data/execute:deny
2156 3:group@:read_data:allow
2157 4:everyone@:write_data/append_data/write_xattr/execute/write_attributes
2158 /write_acl/write_owner:deny
2159 5:everyone@:read_data/read_xattr/read_attributes/read_acl/synchronize
2160 :allow
2161 .fi
2162 .in -2
2163 .sp
2165 .LP
2166 \fBExample 18 \fRReplacing a Specific POSIX-draft ACL on a UFS File
2167 .sp
2168 .LP
2169 Consider the following ACL.
2171 .sp
2172 .in +2
2173 .nf
2174 $ ls -v file.4
2175 -rw-r--r--+ 1 marks staff 0 Oct 9 16:21 file.4
2176 0:user::rw-
2177 1:user:lp:rwx #effective:r--
2178 2:group::r-- #effective:r--
2179 3:mask:r--
2180 4:other:r--
2181 .fi
2182 .in -2
2183 .sp
2185 .sp
2186 .LP
2187 Now, change the permission on \fBlp\fR from \fBrwx\fR to \fBr--\fR:
2189 .sp
2190 .in +2
2191 .nf
2192 $ chmod A1=user:lp:r-- file.4
2194 $ ls -v file
2195 -rw-r--r--+ 1 marks staff 0 Oct 9 16:21 file.4
2196 0:user::rw-
2197 1:user:lp:r-- #effective:r--
2198 2:group::r-- #effective:r--
2199 3:mask:r--
2200 4:other:r--
2201 .fi
2202 .in -2
2203 .sp
2205 .LP
2206 \fBExample 19 \fRSetting ACL Inheritance Flags on a ZFS File
2207 .sp
2208 .LP
2209 You can only set inheritance flags on ZFS files. When setting ACLs on
2210 directories, several inheritance flags can be optionally set.
2212 .sp
2213 .LP
2214 Suppose you have an ACL entry for user \fBlp\fR that you want to be inherited
2215 to newly created files in a directory. First, you need to create an
2216 inheritable ACL entry on the directory:
2218 .sp
2219 .in +2
2220 .nf
2221 $ chmod A+user:lp:read_data:file_inherit:allow test.dir
2222 $ ls -dv test.dir
2223 drwxr-xr-x+ 2 marks staff 2 Aug 23 09:08 test.dir/
2224 0:user:lp:read_data:file_inherit:allow
2225 1:owner@::deny
2226 2:owner@:list_directory/read_data/add_file/write_data/add_subdirectory
2227 /append_data/write_xattr/execute/write_attributes/write_acl
2228 /write_owner:allow
2229 3:group@:add_file/write_data/add_subdirectory/append_data:deny
2230 4:group@:list_directory/read_data/execute:allow
2231 5:everyone@:add_file/write_data/add_subdirectory/append_data/write_xattr
2232 /write_attributes/write_acl/write_owner:deny
2233 6:everyone@:list_directory/read_data/read_xattr/execute/read_attributes
2234 /read_acl/synchronize:allow
2235 .fi
2236 .in -2
2237 .sp
2239 .sp
2240 .LP
2241 The \fBlp\fR entry is inherited to newly created files in the directory
2242 \fBtest.dir\fR.
2244 .sp
2245 .in +2
2246 .nf
2247 $ touch test.dir/file.test
2248 $ ls -v test.dir/file.test
2249 -rw-r--r--+ 1 marks staff 0 Oct 9 16:29 test.dir/file.test
2250 0:user:lp::deny
2251 1:user:lp:read_data:allow
2252 2:owner@:execute:deny
2253 3:owner@:read_data/write_data/append_data/write_xattr/
2254 write_attributes/write_acl/write_owner:allow
2255 4:group@:write_data/append_data/execute:deny
2256 5:group@:read_data:allow
2257 6:everyone@:write_data/append_data/write_xattr/execute/
2258 write_attributes/write_acl/write_owner:deny
2259 7:everyone@:read_data/read_xattr/read_attributes/read_acl/
2260 synchronize:allow
2261 .fi
2262 .in -2
2263 .sp
2265 .sp
2266 .LP
2267 The user \fBlp\fR entry is inherited to the newly created file. Multiple
2268 combinations of the inheritance flags can be specified. For example, if you
2269 wanted the \fBlp\fR entry to also be inherited to directories, then the
2270 following command can be used:
2272 .sp
2273 .in +2
2274 .nf
2275 $ chmod A+user:lp:read_data:file_inherit/\e
2276 dir_inherit:allow test.dir
2277 .fi
2278 .in -2
2279 .sp
2281 .LP
2282 \fBExample 20 \fRReplacing System Attributes of a ZFS File
2283 .sp
2284 .LP
2285 The following examples replace system attributes of a ZFS file:
2287 .sp
2288 .in +2
2289 .nf
2290 $ chmod S=v{archive,hidden,readonly,system,appendonly,\e
2291 nonodump,immutable,noav_modified,noav_quarantined,\e
2292 nounlink,nooffline,nosparse} file1
2293 .fi
2294 .in -2
2295 .sp
2297 .sp
2298 .LP
2299 or
2301 .sp
2302 .in +2
2303 .nf
2304 $ chmod S=c{AHRSaiu} file1
2305 .fi
2306 .in -2
2307 .sp
2309 .sp
2310 .LP
2311 or
2313 .sp
2314 .in +2
2315 .nf
2316 $ chmod S=c{AHRSa-i--u--} file1
2317 .fi
2318 .in -2
2319 .sp
2321 .sp
2322 .LP
2323 or
2325 .sp
2326 .in +2
2327 .nf
2328 $ chmod S=cAHRSaiu file1
2329 .fi
2330 .in -2
2331 .sp
2333 .sp
2334 .LP
2335 or
2337 .sp
2338 .in +2
2339 .nf
2340 $ chmod -@ '..' S=cAHRSaiu file1
2341 .fi
2342 .in -2
2343 .sp
2345 .sp
2346 .LP
2347 Assuming appropriate privileges, this results in the following system
2348 attributes of \fBfile1\fR being set: \fBarchive\fR, \fBhidden\fR,
2349 \fBreadonly\fR, \fBsystem\fR, \fBappendonly\fR, \fBimmutable\fR, and
2350 \fBnounlink\fR. Assuming appropriate privileges, the following system
2351 attributes of \fBfile1\fR are cleared: \fBnodump\fR, \fBav_modified\fR,
2352 \fBav_quarantined\fR, \fBoffline\fR, and \fBsparse\fR.
2354 .LP
2355 \fBExample 21 \fRClearing All System Attributes of a ZFS File
2356 .sp
2357 .LP
2358 The following examples clears all system attributes of a ZFS file:
2360 .sp
2361 .in +2
2362 .nf
2363 $ chmod S-a file1
2364 .fi
2365 .in -2
2366 .sp
2368 .sp
2369 .LP
2370 or
2372 .sp
2373 .in +2
2374 .nf
2375 $ chmod -@ '..' S-a file1
2376 .fi
2377 .in -2
2378 .sp
2380 .sp
2381 .LP
2382 Assuming appropriate privileges, all boolean read-write system attributes are
2383 cleared on \fBfile1\fR.
2385 .LP
2386 \fBExample 22 \fRSetting a System Attribute of a Named Attribute File of a ZFS
2387 File
2388 .sp
2389 .LP
2390 The following example sets a system attribute of a named attribute file of a
2391 ZFS file, but not of the file itself:
2393 .sp
2394 .in +2
2395 .nf
2396 $ chmod -@ myattr S+vhidden file1
2397 .fi
2398 .in -2
2399 .sp
2401 .sp
2402 .LP
2403 This results in the hidden system attribute being set for the named attribute
2404 file \fBmyattr\fR of \fBfile1\fR, but not the file itself.
2406 .LP
2407 \fBExample 23 \fRSetting a System Attribute of All Named Attribute File of a
2408 ZFS File
2409 .sp
2410 .LP
2411 The following example sets a system attribute of all named attribute files of a
2412 ZFS file, but not of the file itself:
2414 .sp
2415 .in +2
2416 .nf
2417 $ chmod -@ '*' S+a file1
2418 .fi
2419 .in -2
2420 .sp
2422 .LP
2423 \fBExample 24 \fRSetting a System Attribute of All Named Attribute Files of a
2424 ZFS File
2425 .sp
2426 .LP
2427 The following example sets a system attribute of all named attribute files of a
2428 ZFS file, as well as of the file itself:
2430 .sp
2431 .in +2
2432 .nf
2433 $ chmod -@ '..' -@ '*' S+vhidden file1
2434 .fi
2435 .in -2
2436 .sp
2438 .sp
2439 .LP
2440 This results in the hidden system attribute being set for all named attribute
2441 files of \fBfile1\fR, as well as the file itself.
2443 .LP
2444 \fBExample 25 \fRRecursively Descending Through a Directory Hierarchy
2445 .sp
2446 .LP
2447 The following example recursively descends through a directory hierarchy, and
2448 sets all system attributes of all named attribute files, the ZFS file operands,
2449 as well as of the directory itself:
2451 .sp
2452 .in +2
2453 .nf
2454 $ chmod -R -@ '..' -@ '*' S+a directory1
2455 .fi
2456 .in -2
2457 .sp
2459 .sp
2460 .LP
2461 This results in the hidden system attribute being set for all named attribute
2462 files of all regular files and directories within the directory hierarchy of
2463 \fBdirectory1\fR, as well as of \fBdirectory1\fR itself.
2465 .LP
2466 \fBExample 26 \fRSetting the \fBhidden\fR and \fBsystem\fR System Attributes of
2467 a ZFS File
2468 .sp
2469 .LP
2470 The following examples set the \fBhidden\fR and \fBsystem\fR system attributes
2471 of a ZFS file:
2473 .sp
2474 .in +2
2475 .nf
2476 $ chmod S+cHS file1
2477 .fi
2478 .in -2
2479 .sp
2481 .sp
2482 .LP
2483 or
2485 .sp
2486 .in +2
2487 .nf
2488 $ chmod S+vhidden,+vsystem file1
2489 .fi
2490 .in -2
2491 .sp
2493 .sp
2494 .LP
2495 or
2497 .sp
2498 .in +2
2499 .nf
2500 $ chmod S+v{hidden,system} file1
2501 .fi
2502 .in -2
2503 .sp
2505 .sp
2506 .LP
2507 or
2509 .sp
2510 .in +2
2511 .nf
2512 $ chmod S+c{-H-S--------} file1
2513 .fi
2514 .in -2
2515 .sp
2517 .sp
2518 .LP
2519 or
2521 .sp
2522 .in +2
2523 .nf
2524 $ chmod S-v{nohidden,nosystem} file1
2525 .fi
2526 .in -2
2527 .sp
2529 .sp
2530 .LP
2531 or
2533 .sp
2534 .in +2
2535 .nf
2536 $ chmod S-v{hidden,system},+v{hidden,system} file1
2537 .fi
2538 .in -2
2539 .sp
2541 .LP
2542 \fBExample 27 \fRClearing All System Attributes of a ZFS File
2543 .sp
2544 .LP
2545 The following example clears all system attributes of a ZFS file:
2547 .sp
2548 .in +2
2549 .nf
2550 $ chmod S-a file1
2551 .fi
2552 .in -2
2553 .sp
2555 .sp
2556 .LP
2557 or
2559 .sp
2560 .in +2
2561 .nf
2562 $ chmod S=v{} file1
2563 .fi
2564 .in -2
2565 .sp
2567 .sp
2568 .LP
2569 In the following two examples, the last attribute operation specified takes
2570 precedence.
2572 .sp
2573 .LP
2574 In this example, the replacement attribute name list (\fB{}\fR) clears all
2575 system attributes for \fBfile1\fR:
2577 .sp
2578 .in +2
2579 .nf
2580 $ chmod S+cHS,=v{} file1
2581 .fi
2582 .in -2
2583 .sp
2585 .sp
2586 .LP
2587 In this example, the clear attributes operation (\fB-a\fR) clears all system
2588 attributes of \fBfile1\fR:
2590 .sp
2591 .in +2
2592 .nf
2593 $ chmod S+vhidden,+vsystem,-a file1
2594 .fi
2595 .in -2
2596 .sp
2598 .LP
2599 \fBExample 28 \fRSetting the Values of All Boolean read-write System Attributes
2600 of a File
2601 .sp
2602 .LP
2603 The following example sets the values of all boolean read-write system
2604 attributes of a file to the same as the boolean read-write system attributes of
2605 another file:
2607 .sp
2608 .in +2
2609 .nf
2610 $ chmod S=v`ls -/v file1|sed -n '2s/.*{/{/p'` file2
2611 .fi
2612 .in -2
2613 .sp
2615 .sp
2616 .LP
2617 Assuming appropriate privileges and that \fBfile1\fR and \fBfile2\fR have the
2618 same supported system attributes, all system attributes of \fBfile1\fR that are
2619 set are also set on \fBfile2\fR. All system attributes of \fBfile1\fR that are
2620 cleared are also cleared on \fBfile2\fR.
2622 .SH ENVIRONMENT VARIABLES
2623 .LP
2624 See \fBenviron\fR(5) for descriptions of the following environment variables
2625 that affect the execution of \fBchmod\fR: \fBLANG\fR, \fBLC_ALL\fR,
2626 \fBLC_CTYPE\fR, \fBLC_MESSAGES\fR, and \fBNLSPATH\fR.
2627 .SH EXIT STATUS
2628 .LP
2629 The following exit values are returned:
2630 .sp
2631 .ne 2
2632 .na
2633 \fB\fB0\fR\fR
2634 .ad
2635 .RS 6n
2636 Successful completion.
2637 .RE
2639 .sp
2640 .ne 2
2641 .na
2642 \fB\fB>0\fR\fR
2643 .ad
2644 .RS 6n
2645 An error occurred.
2646 .RE
2648 .SH ATTRIBUTES
2649 .LP
2650 See \fBattributes\fR(5) for descriptions of the following attributes:
2651 .sp
2653 .sp
2654 .TS
2655 box;
2656 c | c
2657 l | l .
2658 ATTRIBUTE TYPE ATTRIBUTE VALUE
2659 _
2660 CSI Enabled
2661 _
2662 Interface Stability Committed
2663 .TE
2665 .SH SEE ALSO
2666 .LP
2667 \fBgetfacl\fR(1), \fBls\fR(1), \fBsetfacl\fR(1), \fBchmod\fR(2),
2668 \fBfgetattr\fR(3C), \fBacl\fR(5), \fBattributes\fR(5), \fBenviron\fR(5),
2669 \fBfsattr\fR(5), \fBstandards\fR(5)
2670 .SH NOTES
2671 .LP
2672 Absolute changes do not work for the set-group-\fBID\fR bit of a directory. You
2673 must use \fBg+s\fR or \fBg-s\fR.
2674 .sp
2675 .LP
2676 \fBchmod\fR permits you to produce useless modes so long as they are not
2677 illegal (for instance, making a text file executable). \fBchmod\fR does not
2678 check the file type to see if mandatory locking is meaningful.
2679 .sp
2680 .LP
2681 If the filesystem is mounted with the \fInosuid\fR option, \fIsetuid\fR
2682 execution is not allowed.
2683 .sp
2684 .LP
2685 If you use \fBchmod\fR to change the file group owner permissions on a file
2686 with \fBACL\fR entries, both the file group owner permissions and the \fBACL\fR
2687 mask are changed to the new permissions. Be aware that the new \fBACL\fR mask
2688 permissions can change the effective permissions for additional users and
2689 groups who have \fBACL\fR entries on the file. Use the \fBgetfacl\fR(1) or
2690 \fBls\fR(1) command to make sure the appropriate permissions are set for all
2691 \fBACL\fR entries.