| blob | 7aaa33d0128de727523a0fcdc33cfdafd50ca42f |
1 '\" te
2 .\" Copyright 2014 Nexenta Systems, Inc. All rights reserved.
3 .\" Copyright 1989 AT&T.
4 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved.
5 .\" Portions Copyright (c) 1992, X/Open Company Limited All Rights Reserved
6 .\" Sun Microsystems, Inc. gratefully acknowledges The Open Group for permission to reproduce portions of its copyrighted documentation. Original documentation from The Open Group can be obtained online at http://www.opengroup.org/bookstore/.
7 .\" The Institute of Electrical and Electronics Engineers and The Open Group, have given us permission to reprint portions of their documentation. In the following statement, the phrase "this text" refers to portions of the system documentation. Portions of this text
8 .\" are reprinted and reproduced in electronic form in the Sun OS Reference Manual, from IEEE Std 1003.1, 2004 Edition, Standard for Information Technology -- Portable Operating System Interface (POSIX), The Open Group Base Specifications Issue 6, Copyright (C) 2001-2004 by the Institute of Electrical
9 .\" and Electronics Engineers, Inc and The Open Group. In the event of any discrepancy between these versions and the original IEEE and The Open Group Standard, the original IEEE and The Open Group Standard is the referee document. The original Standard can be obtained online at http://www.opengroup.org/unix/online.html.
10 .\" This notice shall appear on any product containing this material.
11 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
12 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
13 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
14 .TH CHMOD 1 "Nov 24, 2014"
15 .SH NAME
16 chmod \- change the permissions mode of a file
17 .SH SYNOPSIS
18 .LP
19 .nf
20 \fBchmod\fR [\fB-fR\fR] \fIabsolute-mode\fR \fIfile\fR ...
21 .fi
23 .LP
24 .nf
25 \fBchmod\fR [\fB-fR\fR] \fIsymbolic-mode-list\fR \fIfile\fR ...
26 .fi
28 .LP
29 .nf
30 \fBchmod\fR [\fB-fR\fR] \fIacl_operation\fR \fIfile\fR ...
31 .fi
33 .LP
34 .nf
35 \fBchmod\fR [\fB-fR\fR] [\fB-@\fR \fInamed_attribute\fR]...\fIattribute_specification_list\fR \fIfile\fR ...
36 .fi
38 .SH DESCRIPTION
39 .LP
40 The \fBchmod\fR utility changes or assigns the mode of a file.
41 .sp
42 .LP
43 \fBchmod\fR can also be used to modify Access Control Lists (ACLs) on files and
44 directories, and to modify boolean read-write system attributes on regular
45 files, directories, and opaque extended attribute files.
46 .SS "Absolute Mode"
47 .LP
48 An absolute mode command line has the following format:
49 .sp
50 .LP
51 \fBchmod\fR [\fIoptions\fR] \fIabsolute-mode\fR \fIfile\fR ...
52 .sp
53 .LP
54 where \fIabsolute-mode\fR is specified using octal numbers \fInnnn\fR defined
55 as follows:
56 .sp
57 .ne 2
58 .na
59 \fB\fIn\fR\fR
60 .ad
61 .RS 5n
62 a number from \fB0\fR to \fB7\fR. An absolute mode is constructed from the OR
63 of any of the following modes:
64 .sp
65 .ne 2
66 .na
67 \fB\fB4000\fR\fR
68 .ad
69 .RS 12n
70 Set user \fBID\fR on execution.
71 .RE
73 .sp
74 .ne 2
75 .na
76 \fB\fB20\fR\fI\|#\|\fR\fB0\fR\fR
77 .ad
78 .RS 12n
79 Set group \fBID\fR on execution if \fI#\fR is \fB7\fR, \fB5\fR, \fB3\fR, or
80 \fB1\fR.
81 .sp
82 Enable mandatory locking if \fI#\fR is \fB6\fR, \fB4\fR, \fB2\fR, or \fB0\fR.
83 .sp
84 For directories, files are created with BSD semantics for propagation of the
85 group ID. With this option, files and subdirectories created in the directory
86 inherit the group ID of the directory, rather than of the current process. For
87 directories, the set-gid bit can only be set or cleared by using symbolic mode.
88 .RE
90 .sp
91 .ne 2
92 .na
93 \fB\fB1000\fR\fR
94 .ad
95 .RS 12n
96 Turn on sticky bit. See \fBchmod\fR(2).
97 .RE
99 .sp
100 .ne 2
101 .na
102 \fB\fB0400\fR\fR
103 .ad
104 .RS 12n
105 Allow read by owner.
106 .RE
108 .sp
109 .ne 2
110 .na
111 \fB\fB0200\fR\fR
112 .ad
113 .RS 12n
114 Allow write by owner.
115 .RE
117 .sp
118 .ne 2
119 .na
120 \fB\fB0100\fR\fR
121 .ad
122 .RS 12n
123 Allow execute (search in directory) by owner.
124 .RE
126 .sp
127 .ne 2
128 .na
129 \fB\fB0700\fR\fR
130 .ad
131 .RS 12n
132 Allow read, write, and execute (search) by owner.
133 .RE
135 .sp
136 .ne 2
137 .na
138 \fB\fB0040\fR\fR
139 .ad
140 .RS 12n
141 Allow read by group.
142 .RE
144 .sp
145 .ne 2
146 .na
147 \fB\fB0020\fR\fR
148 .ad
149 .RS 12n
150 Allow write by group.
151 .RE
153 .sp
154 .ne 2
155 .na
156 \fB\fB0010\fR\fR
157 .ad
158 .RS 12n
159 Allow execute (search in directory) by group.
160 .RE
162 .sp
163 .ne 2
164 .na
165 \fB\fB0070\fR\fR
166 .ad
167 .RS 12n
168 Allow read, write, and execute (search) by group.
169 .RE
171 .sp
172 .ne 2
173 .na
174 \fB\fB0004\fR\fR
175 .ad
176 .RS 12n
177 Allow read by others.
178 .RE
180 .sp
181 .ne 2
182 .na
183 \fB\fB0002\fR\fR
184 .ad
185 .RS 12n
186 Allow write by others.
187 .RE
189 .sp
190 .ne 2
191 .na
192 \fB\fB0001\fR\fR
193 .ad
194 .RS 12n
195 Allow execute (search in directory) by others.
196 .RE
198 .sp
199 .ne 2
200 .na
201 \fB\fB0007\fR\fR
202 .ad
203 .RS 12n
204 Allow read, write, and execute (search) by others.
205 .RE
207 .RE
209 .sp
210 .LP
211 For directories, the \fBsetgid\fR bit cannot be set (or cleared) in absolute
212 mode; it must be set (or cleared) in symbolic mode using \fBg+s\fR (or
213 \fBg-s\fR).
214 .SS "Symbolic Mode"
215 .LP
216 A symbolic mode command line has the following format:
217 .sp
218 .LP
219 \fBchmod\fR [\fIoptions\fR] \fIsymbolic-mode-list\fR \fIfile\fR ...
220 .sp
221 .LP
222 where \fIsymbolic-mode-list\fR is a comma-separated list (with no intervening
223 white space) of symbolic mode expressions of the form:
224 .sp
225 .LP
226 [\fBwho\fR] \fIoperator\fR [\fIpermissions\fR]
227 .sp
228 .LP
229 Operations are performed in the order given. Multiple \fIpermissions\fR letters
230 following a single operator cause the corresponding operations to be performed
231 simultaneously.
232 .sp
233 .ne 2
234 .na
235 \fB\fBwho\fR\fR
236 .ad
237 .RS 14n
238 zero or more of the characters \fBu\fR, \fBg\fR, \fBo\fR, and \fBa\fR
239 specifying whose permissions are to be changed or assigned:
240 .sp
241 .ne 2
242 .na
243 \fB\fBu\fR\fR
244 .ad
245 .RS 5n
246 user's permissions
247 .RE
249 .sp
250 .ne 2
251 .na
252 \fB\fBg\fR\fR
253 .ad
254 .RS 5n
255 group's permissions
256 .RE
258 .sp
259 .ne 2
260 .na
261 \fB\fBo\fR\fR
262 .ad
263 .RS 5n
264 others' permissions
265 .RE
267 .sp
268 .ne 2
269 .na
270 \fB\fBa\fR\fR
271 .ad
272 .RS 5n
273 all permissions (user, group, and other)
274 .RE
276 If \fBwho\fR is omitted, it defaults to \fBa\fR, but the setting of the file
277 mode creation mask (see \fBumask\fR in \fBsh\fR(1) or \fBcsh\fR(1) for more
278 information) is taken into account. When \fBwho\fR is omitted, \fBchmod\fR does
279 not override the restrictions of your user mask.
280 .RE
282 .sp
283 .ne 2
284 .na
285 \fB\fIoperator\fR\fR
286 .ad
287 .RS 14n
288 either \fB+\fR, \fB\(mi\fR, or \fB=\fR, signifying how permissions are to be
289 changed:
290 .sp
291 .ne 2
292 .na
293 \fB\fB+\fR\fR
294 .ad
295 .RS 8n
296 Add permissions.
297 .sp
298 If \fIpermissions\fR are omitted, nothing is added.
299 .sp
300 If \fBwho\fR is omitted, add the file mode bits represented by
301 \fIpermissions\fR, \fIexcept\fR for the those with corresponding bits in the
302 file mode creation mask.
303 .sp
304 If \fBwho\fR is present, add the file mode bits represented by the
305 \fIpermissions\fR.
306 .RE
308 .sp
309 .ne 2
310 .na
311 \fB\fB\(mi\fR\fR
312 .ad
313 .RS 8n
314 Take away permissions.
315 .sp
316 If \fIpermissions\fR are omitted, do nothing.
317 .sp
318 If \fBwho\fR is omitted, clear the file mode bits represented by
319 \fIpermissions\fR, \fIexcept\fR for those with corresponding bits in the file
320 mode creation mask.
321 .sp
322 If \fBwho\fR is present, clear the file mode bits represented by
323 \fIpermissions\fR.
324 .RE
326 .sp
327 .ne 2
328 .na
329 \fB\fB=\fR\fR
330 .ad
331 .RS 8n
332 Assign permissions absolutely.
333 .sp
334 If \fBwho\fR is omitted, clear all file mode bits; if \fBwho\fR is present,
335 clear the file mode bits represented by \fBwho\fR.
336 .sp
337 If \fIpermissions\fR are omitted, do nothing else.
338 .sp
339 If \fBwho\fR is omitted, add the file mode bits represented by
340 \fIpermissions\fR, \fIexcept\fR for the those with corresponding bits in the
341 file mode creation mask.
342 .sp
343 If \fBwho\fR is present, add the file mode bits represented by
344 \fIpermissions\fR.
345 .RE
347 Unlike other symbolic operations, \fB=\fR has an absolute effect in that it
348 resets all other bits represented by \fBwho\fR. Omitting \fIpermissions\fR is
349 useful only with \fB=\fR to take away all permissions.
350 .RE
352 .sp
353 .ne 2
354 .na
355 \fB\fIpermission\fR\fR
356 .ad
357 .RS 14n
358 any compatible combination of the following letters:
359 .sp
360 .ne 2
361 .na
362 \fB\fBl\fR\fR
363 .ad
364 .RS 9n
365 mandatory locking
366 .RE
368 .sp
369 .ne 2
370 .na
371 \fB\fBr\fR\fR
372 .ad
373 .RS 9n
374 read permission
375 .RE
377 .sp
378 .ne 2
379 .na
380 \fB\fBs\fR\fR
381 .ad
382 .RS 9n
383 user or group set-ID
384 .RE
386 .sp
387 .ne 2
388 .na
389 \fB\fBt\fR\fR
390 .ad
391 .RS 9n
392 sticky bit
393 .RE
395 .sp
396 .ne 2
397 .na
398 \fB\fBw\fR\fR
399 .ad
400 .RS 9n
401 write permission
402 .RE
404 .sp
405 .ne 2
406 .na
407 \fB\fBx\fR\fR
408 .ad
409 .RS 9n
410 execute permission
411 .RE
413 .sp
414 .ne 2
415 .na
416 \fB\fBX\fR\fR
417 .ad
418 .RS 9n
419 execute permission if the file is a directory or if there is execute permission
420 for one of the other user classes
421 .RE
423 .sp
424 .ne 2
425 .na
426 \fB\fBu\fR,\fBg\fR,\fBo\fR\fR
427 .ad
428 .RS 9n
429 indicate that \fIpermission\fR is to be taken from the current user, group or
430 other mode respectively.
431 .RE
433 Permissions to a file can vary depending on your user identification number
434 (UID) or group identification number (GID). Permissions are described in three
435 sequences each having three characters:
436 .sp
438 .sp
439 .TS
440 l l l
441 l l l .
442 User Group Other
443 rwx rwx rwx
444 .TE
446 This example (user, group, and others all have permission to read, write, and
447 execute a given file) demonstrates two categories for granting permissions: the
448 access class and the permissions themselves.
449 .sp
450 The letter \fBs\fR is only meaningful with \fBu\fR or \fBg\fR, and \fBt\fR only
451 works with \fBu\fR.
452 .sp
453 Mandatory file and record locking (\fBl\fR) refers to a file's ability to have
454 its reading or writing permissions locked while a program is accessing that
455 file.
456 .sp
457 In a directory which has the set-group-ID bit set (reflected as either
458 \fB-----s---\fR or \fB-----l---\fR in the output of \fB\&'ls -ld'\fR), files
459 and subdirectories are created with the group-ID of the parent directory\(emnot
460 that of current process.
461 .sp
462 It is not possible to permit group execution and enable a file to be locked on
463 execution at the same time. In addition, it is not possible to turn on the
464 set-group-ID bit and enable a file to be locked on execution at the same time.
465 The following examples, therefore, are invalid and elicit error messages:
466 .sp
467 .in +2
468 .nf
469 chmod g+x,+l \fIfile\fR
470 chmod g+s,+l \fIfile\fR
471 .fi
472 .in -2
473 .sp
475 Only the owner of a file or directory (or the super-user) can change that
476 file's or directory's mode. Only the super-user can set the sticky bit on a
477 non-directory file. If you are not super-user, \fBchmod\fR masks the sticky-bit
478 but does not return an error. In order to turn on a file's set-group-ID bit,
479 your own group ID must correspond to the file's and group execution must be
480 set.
481 .RE
483 .SS "ACL Operation"
484 .LP
485 An ACL Operation command line has the following format:
486 .sp
487 .in +2
488 .nf
489 chmod [\fIoptions\fR] A[\fInumber\fR]- \fIfile\fR ...
490 chmod [\fIoptions\fR] A-\fIacl_specification\fR \fIfile\fR ...
491 chmod [\fIoptions\fR] A[\fIindex\fR]{+|=}\fIacl_specification\fR \fIfile\fR ...
492 .fi
493 .in -2
494 .sp
496 .sp
497 .LP
498 Where \fIacl_specification\fR is a comma-separated list (with no intervening
499 white space) of an ACL specification of the form:
500 .sp
501 .ne 2
502 .na
503 \fB\fBA[\fIindex\fR]+\fIacl_specification\fR\fR\fR
504 .ad
505 .RS 30n
506 Prepends the access control entries (ACE) specified in \fIacl_specification\fR
507 to the beginning of the file's ACL. Depending on the file system, the ACL can
508 be reordered when applied to the file. If "optional" number is specified then
509 new ACEs are inserted before specified number.
510 .RE
512 .sp
513 .ne 2
514 .na
515 \fB\fBA-\fR\fR
516 .ad
517 .RS 30n
518 Removes all ACEs for current ACL on file and replaces current ACL with new ACL
519 that represents only the current mode of the file.
520 .RE
522 .sp
523 .ne 2
524 .na
525 \fB\fBA\fIindex\fR\fR-\fR
526 .ad
527 .RS 30n
528 Removes ACE specified by \fIindex\fR number.
529 .RE
531 .sp
532 .ne 2
533 .na
534 \fB\fBA-\fIacl_specification\fR\fR\fR
535 .ad
536 .br
537 .na
538 \fB\fR
539 .ad
540 .RS 30n
541 Removes ACEs specified by \fIacl_specification\fR, if they exist in current
542 file's ACL.
543 .RE
545 .sp
546 .ne 2
547 .na
548 \fB\fBA=\fIacl_specification\fR\fR\fR
549 .ad
550 .RS 30n
551 Replaces a files entire ACL with \fIacl_specification\fR.
552 .RE
554 .sp
555 .ne 2
556 .na
557 \fB\fBA[\fIindex\fR]=\fIacl_specification\fR\fR\fR
558 .ad
559 .RS 30n
560 Replaces ACEs starting at a specific index number in the current ACL on the
561 file. If multiple ACEs are specified, then each subsequent ACE in
562 \fIacl_specification\fR replaces the corresponding ACE in the current ACL.
563 .RE
565 .sp
566 .LP
567 \fBPOSIX-draft ACL Specification (as supported by UFS)\fR
568 .sp
569 .LP
570 POSIX-draft ACLs (as supported by UFS) are specified as colon (\fB:\fR)
571 separated fields of the following.
572 .sp
573 .ne 2
574 .na
575 \fBuser::perms\fR
576 .ad
577 .sp .6
578 .RS 4n
579 File owner permissions.
580 .RE
582 .sp
583 .ne 2
584 .na
585 \fBuser:\fIusername\fR:perms\fR
586 .ad
587 .sp .6
588 .RS 4n
589 Permissions for a specific user.
590 .RE
592 .sp
593 .ne 2
594 .na
595 \fBgroup::perms\fR
596 .ad
597 .sp .6
598 .RS 4n
599 File group owner permissions.
600 .RE
602 .sp
603 .ne 2
604 .na
605 \fBgroup:\fIgroupname:\fRperms\fR
606 .ad
607 .sp .6
608 .RS 4n
609 Permissions for a specific group.
610 .RE
612 .sp
613 .ne 2
614 .na
615 \fBother::perms\fR
616 .ad
617 .sp .6
618 .RS 4n
619 Permissions for user other than the file owner or members of file group owner.
620 .RE
622 .sp
623 .ne 2
624 .na
625 \fBmask:perms\fR
626 .ad
627 .sp .6
628 .RS 4n
629 The ACL mask. The mask entry specifies the maximum permissions allowed for user
630 (other than that the owner) and for groups.
631 .RE
633 .sp
634 .ne 2
635 .na
636 \fBdefault:user::perms\fR
637 .ad
638 .sp .6
639 .RS 4n
640 Default file owner permissions.
641 .RE
643 .sp
644 .ne 2
645 .na
646 \fBdefault:user:\fIusername\fR:perms\fR
647 .ad
648 .sp .6
649 .RS 4n
650 Default permissions for a specific user.
651 .RE
653 .sp
654 .ne 2
655 .na
656 \fBdefault:group::perms\fR
657 .ad
658 .sp .6
659 .RS 4n
660 Default file group owner permissions.
661 .RE
663 .sp
664 .ne 2
665 .na
666 \fBdefault:group:\fIgroupname\fR:perms\fR
667 .ad
668 .sp .6
669 .RS 4n
670 Default permissions for a specific group.
671 .RE
673 .sp
674 .ne 2
675 .na
676 \fBdefault:other:perms\fR
677 .ad
678 .sp .6
679 .RS 4n
680 Default permissions for user other than the file owner or members of the file
681 group owner.
682 .RE
684 .sp
685 .ne 2
686 .na
687 \fBdefault:mask:perms\fR
688 .ad
689 .sp .6
690 .RS 4n
691 Default ACL mask.
692 .RE
694 .sp
695 .LP
696 The above specification allows for ACLs to be specified such as:
697 .sp
698 .in +2
699 .nf
700 user:tom:rw-,mask:rwx,group:staff:r-x
701 .fi
702 .in -2
703 .sp
705 .sp
706 .LP
707 \fBNFSv4 ACL Specification (as supported by NFSv4 and ZFS)\fR
708 .sp
709 .LP
710 NFSv4 ACLs provide richer ACL semantics. They provide both allow and deny
711 entries, finer grained permissions, and enhanced inheritance control.
712 .sp
713 .LP
714 NFSv4 ACLs are specified as colon (\fB:\fR) separated fields of the following.
715 .sp
716 .ne 2
717 .na
718 \fBowner@:<perms>[:inheritance flags]:<allow|deny>\fR
719 .ad
720 .sp .6
721 .RS 4n
722 Permissions for file owner.
723 .RE
725 .sp
726 .ne 2
727 .na
728 \fBgroup@:<perms>[:inheritance flags]:<allow|deny>\fR
729 .ad
730 .sp .6
731 .RS 4n
732 Permissions for file group owner.
733 .RE
735 .sp
736 .ne 2
737 .na
738 \fBeveryone@:<perms>[:inheritance flags]:<allow|deny>\fR
739 .ad
740 .sp .6
741 .RS 4n
742 Permissions for everyone, including file owner and group owner.
743 .RE
745 .sp
746 .ne 2
747 .na
748 \fBuser:<username>:<perms>[:inheritance flags]:<allow|deny>\fR
749 .ad
750 .sp .6
751 .RS 4n
752 Permissions for a specific user.
753 .RE
755 .sp
756 .ne 2
757 .na
758 \fBusersid:<sid string>:<perms>[:inheritance flags]:<allow|deny>\fR
759 .ad
760 .sp .6
761 .RS 4n
762 Permissions for a specific user, but user is specified by SID.
763 .RE
765 .sp
766 .ne 2
767 .na
768 \fBgroup:<groupname>:<perms>[:inheritance flags]:<allow|deny>\fR
769 .ad
770 .sp .6
771 .RS 4n
772 Permissions for a specific group.
773 .RE
775 .sp
776 .ne 2
777 .na
778 \fBgroupsid:<sid string>:<perms>[:inheritance flags]:<allow|deny>\fR
779 .ad
780 .sp .6
781 .RS 4n
782 Permissions for a specific group, but group is specified by SID.
783 .RE
785 .sp
786 .ne 2
787 .na
788 \fBsid:<sid string>:<perms>[:inheritance flags]:<allow|deny>\fR
789 .ad
790 .sp .6
791 .RS 4n
792 Permissions for a specific SID, but it doesn't matter if it is a user or a
793 group.
794 .RE
796 .sp
797 .LP
798 Permissions can be specified in three different \fBchmod\fR ACL formats:
799 verbose, compact, or positional. The verbose format uses words to indicate that
800 the permissions are separated with a forward slash (\fB/\fR) character. Compact
801 format uses the permission letters and positional format uses the permission
802 letters or the hyphen (\fB-\fR) to identify no permissions.
803 .sp
804 .LP
805 The permissions for verbose mode and their abbreviated form in parentheses for
806 compact and positional mode are described as follows:
807 .sp
808 .ne 2
809 .na
810 \fBread_data (\fBr\fR)\fR
811 .ad
812 .RS 24n
813 Permission to read the data of a file.
814 .RE
816 .sp
817 .ne 2
818 .na
819 \fBlist_directory (\fBr\fR)\fR
820 .ad
821 .RS 24n
822 Permission to list the contents of a directory.
823 .RE
825 .sp
826 .ne 2
827 .na
828 \fBwrite_data (\fBw\fR)\fR
829 .ad
830 .RS 24n
831 Permission to modify a file's data. anywhere in the file's offset range.
832 .RE
834 .sp
835 .ne 2
836 .na
837 \fBadd_file (\fBw\fR)\fR
838 .ad
839 .RS 24n
840 Permission to add a new file to a directory.
841 .RE
843 .sp
844 .ne 2
845 .na
846 \fBappend_data (\fBp\fR)\fR
847 .ad
848 .RS 24n
849 The ability to modify a file's data, but only starting at EOF.
850 .sp
851 Currently, this permission is not supported.
852 .RE
854 .sp
855 .ne 2
856 .na
857 \fBadd_subdirectory (\fBp\fR)\fR
858 .ad
859 .RS 24n
860 Permission to create a subdirectory to a directory.
861 .RE
863 .sp
864 .ne 2
865 .na
866 \fBread_xattr (\fBR\fR)\fR
867 .ad
868 .RS 24n
869 Ability to read the extended attributes of a file.
870 .RE
872 .sp
873 .ne 2
874 .na
875 \fBwrite_xattr (\fBW\fR)\fR
876 .ad
877 .RS 24n
878 Ability to create extended attributes or write to the extended attribute
879 directory.
880 .RE
882 .sp
883 .ne 2
884 .na
885 \fBexecute (\fBx\fR)\fR
886 .ad
887 .RS 24n
888 Permission to execute a file.
889 .RE
891 .sp
892 .ne 2
893 .na
894 \fBread_attributes (\fBa\fR)\fR
895 .ad
896 .RS 24n
897 The ability to read basic attributes (non-ACLs) of a file.
898 .RE
900 .sp
901 .ne 2
902 .na
903 \fBwrite_attributes (\fBA\fR)\fR
904 .ad
905 .RS 24n
906 Permission to change the times associated with a file or directory to an
907 arbitrary value.
908 .RE
910 .sp
911 .ne 2
912 .na
913 \fBdelete (\fBd\fR)\fR
914 .ad
915 .RS 24n
916 Permission to delete a file.
917 .RE
919 .sp
920 .ne 2
921 .na
922 \fBdelete_child (\fBD\fR)\fR
923 .ad
924 .RS 24n
925 Permission to delete a file within a directory.
926 .RE
928 .sp
929 .ne 2
930 .na
931 \fBread_acl (\fBc\fR)\fR
932 .ad
933 .RS 24n
934 Permission to read the ACL of a file.
935 .RE
937 .sp
938 .ne 2
939 .na
940 \fBwrite_acl (\fBC\fR)\fR
941 .ad
942 .RS 24n
943 Permission to write the ACL of a file.
944 .RE
946 .sp
947 .ne 2
948 .na
949 \fBwrite_owner (\fBo\fR)\fR
950 .ad
951 .RS 24n
952 Permission to change the owner of a file.
953 .RE
955 .sp
956 .ne 2
957 .na
958 \fBsynchronize (\fBs\fR)\fR
959 .ad
960 .RS 24n
961 Permission to access file locally at server with synchronize reads and writes.
962 .sp
963 Currently, this permission is not supported.
964 .RE
966 .sp
967 .LP
968 Using the compact ACL format, permissions are specified by using 14 unique
969 letters to indicate permissions.
970 .sp
971 .LP
972 Using the positional ACL format, permissions are specified as positional
973 arguments similar to the \fBls\fR \fB-V\fR format. The hyphen (\fB-\fR), which
974 indicates that no permission is granted at that position, can be omitted and
975 only the required letters have to be specified.
976 .sp
977 .LP
978 The letters above are listed in the order they would be specified in positional
979 notation.
980 .sp
981 .LP
982 Permissions can be specified with these letters in the following way:
983 .sp
984 .in +2
985 .nf
986 rwx--D--------
987 .fi
988 .in -2
989 .sp
991 .sp
992 .LP
993 The hyphens can be removed to compact the string as follows:
994 .sp
995 .in +2
996 .nf
997 rwxD
998 .fi
999 .in -2
1000 .sp
1002 .sp
1003 .LP
1004 Several special permission sets or aliases are also supported. The following
1005 permission sets are used the same way that verbose permissions are specified.
1006 .sp
1007 .ne 2
1008 .na
1009 \fB\fBfull_set\fR\fR
1010 .ad
1011 .RS 14n
1012 All permissions.
1013 .RE
1015 .sp
1016 .ne 2
1017 .na
1018 \fB\fBmodify_set\fR\fR
1019 .ad
1020 .RS 14n
1021 All permissions except \fBwrite_acl\fR and \fBwrite_owner\fR.
1022 .RE
1024 .sp
1025 .ne 2
1026 .na
1027 \fB\fBread_set\fR\fR
1028 .ad
1029 .RS 14n
1030 \fBread_data, read_acl, read_attributes,\fR and \fBread_xattr\fR.
1031 .RE
1033 .sp
1034 .ne 2
1035 .na
1036 \fB\fBwrite_set\fR\fR
1037 .ad
1038 .RS 14n
1039 \fBwrite_data, append_data, write_attributes\fR, and \fBwrite_xattr\fR
1040 .RE
1042 .sp
1043 .LP
1044 The optional inheritance flags can be specified in the three formats. The first
1045 format uses words to indicate the various inheritance flags separated with a
1046 forward slash (\fB/\fR) character.
1047 .sp
1048 .ne 2
1049 .na
1050 \fBfile_inherit (\fBf\fR)\fR
1051 .ad
1052 .RS 20n
1053 Inherit to all newly created files.
1054 .RE
1056 .sp
1057 .ne 2
1058 .na
1059 \fBdir_inherit (\fBd\fR)\fR
1060 .ad
1061 .RS 20n
1062 Inherit to all newly created directories.
1063 .RE
1065 .sp
1066 .ne 2
1067 .na
1068 \fBinherit_only (\fBi\fR)\fR
1069 .ad
1070 .RS 20n
1071 When placed on a directory, do not apply to the directory, only to newly
1072 created files and directories. This flag requires that either
1073 \fBfile_inherit\fR and or \fBdir_inherit\fR is also specified.
1074 .RE
1076 .sp
1077 .ne 2
1078 .na
1079 \fBno_propagate (\fBn\fR)\fR
1080 .ad
1081 .RS 20n
1082 Indicates that ACL entries should be inherited to objects in a directory, but
1083 inheritance should stop after descending one level. This flag is dependent upon
1084 either \fBfile_inherit\fR and or \fBdir_inherit\fR also being specified.
1085 .RE
1087 .sp
1088 .ne 2
1089 .na
1090 \fBsuccessful_access (\fBS\fR)\fR
1091 .ad
1092 .RS 20n
1093 Indicates whether an alarm or audit record should be initiated upon successful
1094 accesses. Used with audit/alarm ACE types.
1095 .RE
1097 .sp
1098 .ne 2
1099 .na
1100 \fBfailed_access (\fBF\fR)\fR
1101 .ad
1102 .RS 20n
1103 Indicates whether an alarm or audit record should be initiated when access
1104 fails. Used with audit/alarm ACE types.
1105 .RE
1107 .sp
1108 .ne 2
1109 .na
1110 \fBinherited (\fBI\fR)\fR
1111 .ad
1112 .RS 20n
1113 ACE was inherited.
1114 .RE
1116 .sp
1117 .LP
1118 The inheritance flags listed can also be specified in the compact format or as
1119 positional arguments similar to the \fBls\fR \fB-V\fR format. A hyphen
1120 character indicates that the inheritance flag at that position is not specified
1121 in the positional ACL format.
1122 .sp
1123 .LP
1124 The inheritance flags can be specified with these letters in any of the
1125 following equivalent ways.
1126 .sp
1127 .in +2
1128 .nf
1129 file_inherit/dir_inherit/no_propagate
1130 .fi
1131 .in -2
1132 .sp
1134 .sp
1135 .in +2
1136 .nf
1137 fd-n---
1138 .fi
1139 .in -2
1140 .sp
1142 .sp
1143 .in +2
1144 .nf
1145 fdn
1146 .fi
1147 .in -2
1148 .sp
1150 .sp
1151 .LP
1152 With this inheritance model, an ACL entry can be specified such as:
1153 .sp
1154 .in +2
1155 .nf
1156 user:tom:read_data/write_data/read_attributes:file_inherit:allow
1157 user:fred:read_data:file_inherit/dir_inherit:deny
1158 user:bob:read_data:allow
1159 .fi
1160 .in -2
1161 .sp
1163 .SS "Attribute Operation"
1164 .LP
1165 An attribute operation command line has the following format:
1166 .sp
1167 .in +2
1168 .nf
1169 chmod [\fIoptions\fR] \fIattribute_specification_list\fR \fIfile\fR ...
1170 .fi
1171 .in -2
1172 .sp
1174 .sp
1175 .LP
1176 where \fIattribute_specification_list\fR is the character \fBS\fR followed by a
1177 comma-separated list of one or more \fIattribute_specifications\fR. Each
1178 \fIattribute_specification\fR is of the form:
1179 .sp
1180 .in +2
1181 .nf
1182 [\fIoperator\fR]\fIattribute_specifier\fR
1183 .fi
1184 .in -2
1185 .sp
1187 .sp
1188 .LP
1189 An \fIoperator\fR is one of the following:
1190 .sp
1191 .ne 2
1192 .na
1193 \fB\fB+\fR\fR
1194 .ad
1195 .RS 5n
1196 Each attribute specified by the associated \fIattribute_specifier\fR is
1197 adjusted to match the value specified by the \fIattribute_specifier\fR.
1198 .RE
1200 .sp
1201 .ne 2
1202 .na
1203 \fB\fB-\fR\fR
1204 .ad
1205 .RS 5n
1206 Each attribute specified by the associated \fIattribute_specifier\fR is
1207 adjusted to match the inverse of the value specified by the
1208 \fIattribute_specifier\fR.
1209 .RE
1211 .sp
1212 .ne 2
1213 .na
1214 \fB\fB=\fR\fR
1215 .ad
1216 .RS 5n
1217 Each attribute specified by the associated \fIattribute_specifier\fR is
1218 adjusted to match the value specified by the \fIattribute_specifier\fR. Any
1219 boolean read-write extended system attributes associated with the current file
1220 that are not specified by \fIattribute_specifier\fR is cleared.
1221 .RE
1223 .sp
1224 .LP
1225 If an \fIoperator\fR is not specified in an \fIattribute_specification\fR,
1226 \fBchmod\fR behaves as if \fB+\fR had been specified.
1227 .sp
1228 .LP
1229 An \fIattribute_specifier\fR takes one of the following forms:
1230 .sp
1231 .ne 2
1232 .na
1233 \fB\fBa\fR\fR
1234 .ad
1235 .sp .6
1236 .RS 4n
1237 Set all boolean read-write extended system attributes associated with the
1238 current file.
1239 .RE
1241 .sp
1242 .ne 2
1243 .na
1244 \fB\fBc[\fIcompact_attribute_list\fR]\fR\fR
1245 .ad
1246 .br
1247 .na
1248 \fB\fBc'{'\fIcompact_attribute_list\fR'}'\fR\fR
1249 .ad
1250 .sp .6
1251 .RS 4n
1252 Set each boolean read-write extended system attribute identified by
1253 \fIcompact_attribute_list\fR.
1254 .RE
1256 .sp
1257 .ne 2
1258 .na
1259 \fB\fBv[\fIverbose_attribute_setting\fR]\fR\fR
1260 .ad
1261 .br
1262 .na
1263 \fB\fBv['{'\fIverbose_attribute_setting_list\fR'}']\fR\fR
1264 .ad
1265 .sp .6
1266 .RS 4n
1267 Set each boolean read-write extended system attribute identified by
1268 \fIverbose_attribute_setting\fR.
1269 .RE
1271 .sp
1272 .LP
1273 A \fIcompact_attribute_list\fR is a list of zero or more adjacent attribute
1274 abbreviation characters from list of \fBAttribute Names and Abbreviation
1275 Characters\fR later in this section. An arbitrary number of hyphen (\fB-\fR)
1276 characters can be included in a \fIcompact_attribute_list\fR. These are
1277 ignored.
1278 .sp
1279 .LP
1280 A \fIverbose_attribute_setting\fR is an attribute name from the list of
1281 \fBAttribute Names and Abbreviation Characters\fR later in this section,
1282 optionally, immediately preceded by \fBno\fR. If the attribute name is used
1283 without \fBno\fR, the attribute is set; otherwise the attribute is cleared.
1284 .sp
1285 .LP
1286 A \fIverbose_attribute_setting_list\fR is zero or more comma-separated
1287 \fIverbose_attribute_setting\fRs.
1288 .sp
1289 .LP
1290 Multiple operations specified for a file are accumulated and are all set for a
1291 file operand as a single attribute setting operation. If an attribute is
1292 specified more than once in an \fIattribute_specification_list\fR, the last
1293 specified operation is applied.
1294 .sp
1295 .LP
1296 The following is a list of \fBAttribute Names and Abbreviation Characters\fR:
1297 .sp
1298 .ne 2
1299 .na
1300 \fB\fBAttribute Name\fR\fR
1301 .ad
1302 .RS 18n
1303 \fBAbbreviation Character\fR
1304 .RE
1306 .sp
1307 .ne 2
1308 .na
1309 \fB\fBhidden\fR\fR
1310 .ad
1311 .RS 18n
1312 \fBH\fR
1313 .RE
1315 .sp
1316 .ne 2
1317 .na
1318 \fB\fBsystem\fR\fR
1319 .ad
1320 .RS 18n
1321 \fBS\fR
1322 .RE
1324 .sp
1325 .ne 2
1326 .na
1327 \fB\fBreadonly\fR\fR
1328 .ad
1329 .RS 18n
1330 \fBR\fR
1331 .RE
1333 .sp
1334 .ne 2
1335 .na
1336 \fB\fBarchive\fR\fR
1337 .ad
1338 .RS 18n
1339 \fBA\fR
1340 .RE
1342 .sp
1343 .ne 2
1344 .na
1345 \fB\fBnounlink\fR\fR
1346 .ad
1347 .RS 18n
1348 \fBu\fR
1349 .RE
1351 .sp
1352 .ne 2
1353 .na
1354 \fB\fBimmutable\fR\fR
1355 .ad
1356 .RS 18n
1357 \fBi\fR
1358 .RE
1360 .sp
1361 .ne 2
1362 .na
1363 \fB\fBappendonly\fR\fR
1364 .ad
1365 .RS 18n
1366 \fBa\fR
1367 .RE
1369 .sp
1370 .ne 2
1371 .na
1372 \fB\fBnodump\fR\fR
1373 .ad
1374 .RS 18n
1375 \fBd\fR
1376 .RE
1378 .sp
1379 .ne 2
1380 .na
1381 \fB\fBav_quarantined\fR\fR
1382 .ad
1383 .RS 18n
1384 \fBq\fR
1385 .RE
1387 .sp
1388 .ne 2
1389 .na
1390 \fB\fBav_modified\fR\fR
1391 .ad
1392 .RS 18n
1393 \fBm\fR
1394 .RE
1396 .sp
1397 .ne 2
1398 .na
1399 \fB\fBoffline\fR\fR
1400 .ad
1401 .RS 18n
1402 \fBO\fR
1403 .RE
1405 .sp
1406 .ne 2
1407 .na
1408 \fB\fBsparse\fR\fR
1409 .ad
1410 .RS 18n
1411 \fBs\fR
1412 .RE
1414 .SH OPTIONS
1415 .LP
1416 The following options are supported:
1417 .sp
1418 .ne 2
1419 .na
1420 \fB\fB-f\fR\fR
1421 .ad
1422 .RS 22n
1423 Force. \fBchmod\fR does not complain if it fails to change the mode of a file.
1424 .RE
1426 .sp
1427 .ne 2
1428 .na
1429 \fB\fB-R\fR\fR
1430 .ad
1431 .RS 22n
1432 Recursively descend through directory arguments, setting the mode for each
1433 file. When symbolic links are encountered, the mode of the target file is
1434 changed, but no recursion takes place.
1435 .RE
1437 .sp
1438 .ne 2
1439 .na
1440 \fB\fB-@\fR \fInamed_attribute\fR\fR
1441 .ad
1442 .RS 22n
1443 Perform the attribute operation on the named extended attribute file of each
1444 file operand instead of the file operand itself. If multiple \fB-@\fR
1445 operations are supplied, the attribute specification mode is applied to each of
1446 the named attribute files.
1447 .sp
1448 A named attribute of \fB*\fR carries meaning to \fBchmod\fR, and is considered
1449 to mean all extended attribute files associated with a file operand. This does
1450 not refer to the special files \fB\&.\fR and \fB\&..\fR.
1451 .sp
1452 A named attribute of \fB\&..\fR carries special meaning to \fBchmod\fR, and is
1453 considered to mean the file operand itself. This allows \fBchmod\fR, in a
1454 single call, to apply the attribute specification mode to the specified named
1455 attribute file of the file operand and the file operand itself.
1456 .RE
1458 .SH OPERANDS
1459 .LP
1460 The following operands are supported:
1461 .sp
1462 .ne 2
1463 .na
1464 \fB\fIabsolute-mode\fR\fR
1465 .ad
1466 .br
1467 .na
1468 \fB\fIsymbolic-mode-list\fR\fR
1469 .ad
1470 .sp .6
1471 .RS 4n
1472 Represents the change to be made to the file mode bits of each file named by
1473 one of the \fIfile\fR operands. See \fBAbsolute Mode\fR and \fBSymbolic Mode\fR
1474 in the \fBDESCRIPTION\fR section of this manual page for more information.
1475 .RE
1477 .sp
1478 .ne 2
1479 .na
1480 \fB\fIacl_operation\fR\fR
1481 .ad
1482 .sp .6
1483 .RS 4n
1484 Represents the modification to be performed on the file's ACL. See \fBACL
1485 Operation\fR in the \fBDESCRIPTION\fR section for more information.
1486 .sp
1487 \fIacl_operation\fR is one of the following:
1488 .sp
1489 .in +2
1490 .nf
1491 \fBA[\fR\fInumber\fR\fB] -\fR
1492 \fBA-\fR\fIacl_specification\fR
1493 \fBA[\fR\fIindex\fR\fB]{+|=}\fR\fBacl_specification\fR
1494 .fi
1495 .in -2
1496 .sp
1498 .RE
1500 .sp
1501 .ne 2
1502 .na
1503 \fB\fIattribute_specification_list\fR\fR
1504 .ad
1505 .sp .6
1506 .RS 4n
1507 Represents the modification to performed on the file's attributes. See
1508 Attribute Operation in the \fBDESCRIPTION\fR section of this manual page for
1509 more information.
1510 .RE
1512 .sp
1513 .ne 2
1514 .na
1515 \fB\fIfile\fR\fR
1516 .ad
1517 .sp .6
1518 .RS 4n
1519 A path name of a file whose file mode bits are to be modified.
1520 .RE
1522 .SH USAGE
1523 .LP
1524 See \fBlargefile\fR(5) for the description of the behavior of \fBchmod\fR when
1525 encountering files greater than or equal to 2 Gbyte (2^31 bytes).
1526 .SH EXAMPLES
1527 .LP
1528 \fBExample 1 \fRDenying \fBexecute\fR Permission
1529 .sp
1530 .LP
1531 The following example denies execute permission to everyone:
1533 .sp
1534 .in +2
1535 .nf
1536 % chmod a-x \fIfile\fR
1537 .fi
1538 .in -2
1539 .sp
1541 .LP
1542 \fBExample 2 \fRAllowing \fBread-only\fR Permission
1543 .sp
1544 .LP
1545 The following example allows only read permission to everyone:
1547 .sp
1548 .in +2
1549 .nf
1550 % chmod 444 \fIfile\fR
1551 .fi
1552 .in -2
1553 .sp
1555 .LP
1556 \fBExample 3 \fRMaking a File \fBreadable\fR and \fBwritable\fR
1557 .sp
1558 .LP
1559 The following example makes a file readable and writable by the group and
1560 others:
1562 .sp
1563 .in +2
1564 .nf
1565 % chmod go+rw \fIfile\fR
1566 % chmod 066 \fIfile\fR
1567 .fi
1568 .in -2
1569 .sp
1571 .LP
1572 \fBExample 4 \fRLocking a File From Access
1573 .sp
1574 .LP
1575 The following example locks a file from access:
1577 .sp
1578 .in +2
1579 .nf
1580 $ chmod +l \fIfile\fR
1581 .fi
1582 .in -2
1583 .sp
1585 .LP
1586 \fBExample 5 \fRGranting \fBread\fR, \fBwrite\fR, \fBexecute\fR, and \fBset
1587 group-ID\fR Permission on a File
1588 .sp
1589 .LP
1590 The following example grants everyone read, write, and execute permissions on
1591 the file, and turns on the set group-ID:
1593 .sp
1594 .in +2
1595 .nf
1596 $ chmod a=rwx,g+s \fIfile\fR
1597 $ chmod 2777 \fIfile\fR
1598 .fi
1599 .in -2
1600 .sp
1602 .LP
1603 \fBExample 6 \fRPrepending a New ACL Entry on a ZFS File
1604 .sp
1605 .LP
1606 The following example prepends a new ACL entry on a ZFS file.
1608 .sp
1609 .LP
1610 First, display the current ACL:
1612 .sp
1613 .in +2
1614 .nf
1615 $ ls -v file.3
1616 -rw-r--r-- 1 marks staff 0 Oct 9 15:49 file.3
1617 0:owner@:execute:deny
1618 1:owner@:read_data/write_data/append_data/write_xattr/
1619 write_attributes/write_acl/write_owner:allow
1620 2:group@:write_data/append_data/execute:deny
1621 3:group@:read_data:allow
1622 4:everyone@:write_data/append_data/write_xattr/execute/
1623 write_attributes/write_acl/write_owner:deny
1624 5:everyone@:read_data/read_xattr/read_attributes/read_acl/
1625 synchronize:allow
1626 .fi
1627 .in -2
1628 .sp
1630 .sp
1631 .LP
1632 Issue the following command:
1634 .sp
1635 .in +2
1636 .nf
1637 $ chmod A+user:lp:read_data:deny file.3
1638 .fi
1639 .in -2
1640 .sp
1642 .sp
1643 .LP
1644 Display the new ACL:
1646 .sp
1647 .in +2
1648 .nf
1649 $ ls -v file.3
1650 -rw-r--r--+ 1 marks staff 0 Oct 9 15:49 file.3
1651 0:user:lp:read_data:deny
1652 1:owner@:execute:deny
1653 2:owner@:read_data/write_data/append_data/write_xattr/
1654 write_attributes/write_acl/write_owner:allow
1655 3:group@:write_data/append_data/execute:deny
1656 4:group@:read_data:allow
1657 5:everyone@:write_data/append_data/write_xattr/execute/
1658 write_attributes/write_acl/write_owner:deny
1659 6:everyone@:read_data/read_xattr/read_attributes/read_acl/
1660 synchronize:allow
1661 .fi
1662 .in -2
1663 .sp
1665 .LP
1666 \fBExample 7 \fRPrepending a New POSIX-draft ACL Entry on a UFS File
1667 .sp
1668 .LP
1669 The following example prepends a new POSIX-draft ACL entry on a UFS file.
1671 .sp
1672 .LP
1673 First, display the current ACL:
1675 .sp
1676 .in +2
1677 .nf
1678 $ ls -v file.2
1679 -rw-r--r-- 1 marks staff 0 Oct 9 15:52 file.2
1680 0:user::rw-
1681 1:group::r-- #effective:r--
1682 2:mask:r--
1683 3:other:r--
1684 .fi
1685 .in -2
1686 .sp
1688 .sp
1689 .LP
1690 Issue the following command:
1692 .sp
1693 .in +2
1694 .nf
1695 $ chmod A+user:lp:-wx file.2
1696 .fi
1697 .in -2
1698 .sp
1700 .sp
1701 .LP
1702 Display the new ACL:
1704 .sp
1705 .in +2
1706 .nf
1707 $ ls -v file.2
1708 -rw-r--r--+ 1 marks staff 0 Oct 9 15:52 file.2
1709 0:user::rw-
1710 1:user:lp:-wx #effective:---
1711 2:group::r-- #effective:r--
1712 3:mask:r--
1713 4:other:r--
1714 .fi
1715 .in -2
1716 .sp
1718 .LP
1719 \fBExample 8 \fRInserting an ACL Entry in a Specific Position on a ZFS file
1720 .sp
1721 .LP
1722 The following example inserts an ACL entry in a specific position on a ZFS file
1723 system. It also illustrates the compact ACL format.
1725 .sp
1726 .LP
1727 First, display the ACL to pick a location to insert a new ACE.
1729 .sp
1730 .in +2
1731 .nf
1732 % ls -V file.1
1733 -rw-r--r--+ 1 root root 0 Oct 6 12:16 file.1
1734 user:lp:rw------------:-------:allow
1735 owner@:--x-----------:-------:deny
1736 owner@:rw-p---A-W-Co-:-------:allow
1737 group@:-wxp----------:-------:deny
1738 group@:r-------------:-------:allow
1739 everyone@:-wxp---A-W-Co-:-------:deny
1740 everyone@:r-----a-R-c--s:-------:allow
1741 .fi
1742 .in -2
1743 .sp
1745 .sp
1746 .LP
1747 Next, insert a new entry in location 3. This causes the entries that are
1748 currently in position 3 - 6 to be pushed down.
1750 .sp
1751 .LP
1752 Issue the following command:
1754 .sp
1755 .in +2
1756 .nf
1757 $ chmod A3+user:marks:r:deny file.1
1758 .fi
1759 .in -2
1760 .sp
1762 .sp
1763 .LP
1764 Display the new ACL:
1766 .sp
1767 .in +2
1768 .nf
1769 $ ls -V file.1
1770 -rw-r--r--+ 1 root staff 0 Feb 3 14:13 file.1
1771 user:lp:rw------------:-------:allow
1772 owner@:--x-----------:-------:deny
1773 owner@:rw-p---A-W-Co-:-------:allow
1774 user:marks:r-------------:-------:deny
1775 group@:-wxp----------:-------:deny
1776 group@:r-------------:-------:allow
1777 everyone@:-wxp---A-W-Co-:-------:deny
1778 everyone@:r-----a-R-c--s:-------:allow
1779 .fi
1780 .in -2
1781 .sp
1783 .LP
1784 \fBExample 9 \fRInserting a POSIX-draft ACL in a Specific Position on a UFS
1785 File
1786 .sp
1787 .LP
1788 The file system reorders ACLs when they are stored in the file system. The
1789 following example illustrates this behavior.
1791 .sp
1792 .in +2
1793 .nf
1794 $ ls -v file.1
1795 -rw-r--r--+ 1 root root 0 Sep 29 16:10 file.1
1796 0:user::rw-
1797 1:user:lp:rw- #effective:r--
1798 2:group::r-- #effective:r--
1799 3:mask:r--
1800 4:other:r--
1801 .fi
1802 .in -2
1803 .sp
1805 .sp
1806 .LP
1807 Now, insert an entry at index position 3. The command works, but the file
1808 system reorders the ACL.
1810 .sp
1811 .in +2
1812 .nf
1813 $ chmod A3+user:marks:rw- file.1
1814 $ ls -v file.1
1815 -rw-r--r--+ 1 root root 0 Sep 29 16:10 file.1
1816 0:user::rw-
1817 1:user:lp:rw- #effective:r--
1818 2:user:marks:rw- #effective:r--
1819 3:group::r-- #effective:r--
1820 4:mask:r--
1821 5:other:r--
1822 .fi
1823 .in -2
1824 .sp
1826 .sp
1827 .LP
1828 Rather than inserting the ACL entry in position 3 as requested, it actually
1829 ends up in position 2.
1831 .LP
1832 \fBExample 10 \fRRemoving an ACL Entry on a ZFS File
1833 .sp
1834 .LP
1835 The following example removes the \fBlp\fR entry from an ACL:
1837 .sp
1838 .in +2
1839 .nf
1840 $ ls -v file.3
1841 -rw-r--r--+ 1 marks staff 0 Oct 9 15:49 file.3
1842 0:user:lp:read_data:deny
1843 1:owner@:execute:deny
1844 2:owner@:read_data/write_data/append_data/write_xattr/
1845 write_attributes/write_acl/write_owner:allow
1846 3:group@:write_data/append_data/execute:deny
1847 4:group@:read_data:allow
1848 5:everyone@:write_data/append_data/write_xattr/execute/
1849 write_attributes/write_acl/write_owner:deny
1850 6:everyone@:read_data/read_xattr/read_attributes/read_acl/
1851 synchronize:allow
1852 .fi
1853 .in -2
1854 .sp
1856 .sp
1857 .in +2
1858 .nf
1859 $ chmod A-user:lp:read_data:deny file.3
1860 $ ls -v file.3
1861 -rw-r--r-- 1 marks staff 0 Oct 9 15:49 file.3
1862 0:owner@:execute:deny
1863 1:owner@:read_data/write_data/append_data/write_xattr/
1864 write_attributes/write_acl/write_owner:allow
1865 2:group@:write_data/append_data/execute:deny
1866 3:group@:read_data:allow
1867 4:everyone@:write_data/append_data/write_xattr/execute/
1868 write_attributes/write_acl/write_owner:deny
1869 5:everyone@:read_data/read_xattr/read_attributes/read_acl/
1870 synchronize:allow
1871 .fi
1872 .in -2
1873 .sp
1875 .LP
1876 \fBExample 11 \fRRemoving a POSIX-draft ACL on a UFS File
1877 .sp
1878 .LP
1879 The following example removes the \fBlp\fR entry from an ACL:
1881 .sp
1882 .in +2
1883 .nf
1884 $ ls -v file.2
1885 -rw-r--r--+ 1 marks staff 0 Oct 9 15:52 file.2
1886 0:user::rw-
1887 1:user:lp:-wx #effective:---
1888 2:group::r-- #effective:r--
1889 3:mask:r--
1890 4:other:r--
1891 .fi
1892 .in -2
1893 .sp
1895 .sp
1896 .in +2
1897 .nf
1898 $ chmod A-user:lp:-wx file.2
1899 $ ls -v file.2
1900 -rw-r--r-- 1 marks staff 0 Oct 9 15:52 file.2
1901 0:user::rw-
1902 1:group::r-- #effective:r--
1903 2:mask:r--
1904 3:other:r--
1905 .fi
1906 .in -2
1907 .sp
1909 .LP
1910 \fBExample 12 \fRRemoving a Specific ACL Entry by Index Number on a ZFS File
1911 .sp
1912 .LP
1913 Consider the following ACL:
1915 .sp
1916 .in +2
1917 .nf
1918 $ ls -v file
1919 0:group:staff:read_data/write_data/execute/read_acl:allow
1920 1:user:bin:read_data:deny
1921 2:user:bin:read_data:allow
1922 3:owner@:write_data/append_data:deny
1923 4:owner@:read_data/write_xattr/execute/write_attributes/write_acl
1924 /write_owner:allow
1925 5:group@:write_data/append_data:deny
1926 6:group@:read_data/execute:allow
1927 7:everyone@:write_data/append_data/write_xattr/write_attributes
1928 /write_acl/write_owner:deny
1929 8:everyone@:read_data/read_xattr/execute/read_attributes/read_acl
1930 /synchronize:allow
1931 .fi
1932 .in -2
1933 .sp
1935 .sp
1936 .LP
1937 Remove the second user entry for bin.
1939 .sp
1940 .in +2
1941 .nf
1942 $ chmod A2- file
1943 $ ls -v file
1944 0:group:staff:read_data/write_data/execute/read_acl:allow
1945 1:user:bin:read_data:deny
1946 2:owner@:write_data/append_data:deny
1947 3:owner@:read_data/write_xattr/execute/write_attributes/write_acl
1948 /write_owner:allow
1949 4:group@:write_data/append_data:deny
1950 5:group@:read_data/execute:allow
1951 6:everyone@:write_data/append_data/write_xattr/write_attributes
1952 /write_acl/write_owner:deny
1953 7:everyone@:read_data/read_xattr/execute/read_attributes/read_acl
1954 /synchronize:allow
1955 .fi
1956 .in -2
1957 .sp
1959 .LP
1960 \fBExample 13 \fRRemoving a Specific POSIX-draft ACL Entry on a UFS File
1961 .sp
1962 .LP
1963 The following example removes the lp entry by index number from the following
1964 ACL:
1966 .sp
1967 .in +2
1968 .nf
1969 $ ls -v file.1
1970 -rw-r--r--+ 1 root root 0 Sep 29 16:10 file.1
1971 0:user::rw-
1972 1:user:lp:rw- #effective:r--
1973 2:group::r-- #effective:r--
1974 3:mask:r--
1975 4:other:r--
1977 $ chmod A1- file.1
1978 $ ls -v
1979 -rw-r--r--+ 1 root root 0 Sep 29 16:10 file.1
1980 0:user::rw-
1981 1:group::r-- #effective:r--
1982 2:mask:r--
1983 3:other:r--
1984 .fi
1985 .in -2
1986 .sp
1988 .LP
1989 \fBExample 14 \fRRemoving All ACLs From a File
1990 .sp
1991 .LP
1992 The following command works with either NFSv4/ZFS or POSIX-draft ACLs.
1994 .sp
1995 .LP
1996 Consider the following ACL:
1998 .sp
1999 .in +2
2000 .nf
2001 $ ls -v file.3
2002 -rw-r--r--+ 1 marks staff 0 Oct 9 15:49 file.3
2003 0:user:lp:read_data/write_data:allow
2004 1:user:marks:read_acl:allow
2005 2:owner@:execute:deny
2006 3:owner@:read_data/write_data/append_data/write_xattr/
2007 write_attributes/write_acl/write_owner:allow
2008 4:group@:write_data/append_data/execute:deny
2009 5:group@:read_data:allow
2010 6:everyone@:write_data/append_data/write_xattr/execute/
2011 write_attributes/write_acl/write_owner:deny
2012 7:everyone@:read_data/read_xattr/read_attributes/read_acl/
2013 synchronize:allow
2014 .fi
2015 .in -2
2016 .sp
2018 .sp
2019 .LP
2020 The existing ACL is effectively removed and is replaced with an ACL that
2021 represents the permission bits of the file.
2023 .sp
2024 .in +2
2025 .nf
2026 $ chmod A- file.3
2027 $ ls -v file.3
2028 -rw-r--r-- 1 marks staff 0 Oct 9 15:49 file.3
2029 0:owner@:execute:deny
2030 1:owner@:read_data/write_data/append_data/write_xattr/
2031 write_attributes/write_acl/write_owner:allow
2032 2:group@:write_data/append_data/execute:deny
2033 3:group@:read_data:allow
2034 4:everyone@:write_data/append_data/write_xattr/execute/
2035 write_attributes/write_acl/write_owner:deny
2036 5:everyone@:read_data/read_xattr/read_attributes/read_acl/
2037 synchronize:allow
2038 .fi
2039 .in -2
2040 .sp
2042 .LP
2043 \fBExample 15 \fRReplacing an Entire ACL Entry on a ZFS File
2044 .sp
2045 .LP
2046 Use the following \fBchmod\fR syntax if you want to replace an ACL in its
2047 entirety:
2049 .sp
2050 .in +2
2051 .nf
2052 $ chmod A=owner@:read_data/write_data:allow,group@:read_data/
2053 write_data:allow,user:lp:read_data:allow file.4
2054 $ ls -v file.4
2055 -rw-rw----+ 1 marks staff 0 Oct 9 16:12 file.4
2056 0:owner@:read_data/write_data:allow
2057 1:group@:read_data/write_data:allow
2058 2:user:lp:read_data:allow
2059 .fi
2060 .in -2
2061 .sp
2063 .LP
2064 \fBExample 16 \fRReplacing an Entire POSIX-draft ACL on a UFS File
2065 .sp
2066 .LP
2067 This operation is a little more complicated. The replacement ACL needs the
2068 necessary entries to represent the file owner, file group owner, other, mask
2069 and any additional entries you wish to set.
2071 .sp
2072 .in +2
2073 .nf
2074 $ chmod A=user::rw-,group::rw-,other::---,mask:r--,
2075 user:lp:r-- file.3
2076 $ ls -v file.3
2077 -rw-r-----+ 1 root root 0 Oct 9 16:14 file.3
2078 0:user::rw-
2079 1:user:lp:r-- #effective:r--
2080 2:group::rw- #effective:r--
2081 3:mask:r--
2082 4:other:---
2083 .fi
2084 .in -2
2085 .sp
2087 .LP
2088 \fBExample 17 \fRReplacing a Specific Entry on a ZFS File
2089 .sp
2090 .LP
2091 Consider the following ACL.
2093 .sp
2094 .in +2
2095 .nf
2096 $ ls -v file.5
2097 -rw-r--r--+ 1 marks staff 0 Oct 9 16:18 file.5
2098 0:user:marks:read_data:allow
2099 1:owner@:execute:deny
2100 2:owner@:read_data/write_data/append_data/write_xattr/
2101 write_attributes/write_acl/write_owner:allow
2102 3:group@:write_data/append_data/execute:deny
2103 4:group@:read_data:allow
2104 5:everyone@:write_data/append_data/write_xattr/execute/
2105 write_attributes/write_acl/write_owner:deny
2106 6:everyone@:read_data/read_xattr/read_attributes/read_acl/
2107 synchronize:allow
2108 .fi
2109 .in -2
2110 .sp
2112 .sp
2113 .LP
2114 Now, change the allow access to a deny for user marks:
2116 .sp
2117 .in +2
2118 .nf
2119 $ chmod A0=user:marks:read_data:deny file.5
2120 $ ls -v file.5
2121 -rw-r--r--+ 1 marks staff 0 Aug 23 09:11 file.5
2122 0:user:marks:read_data:deny
2123 1:owner@:read_data/write_data/append_data/write_xattr/write_attributes
2124 /write_acl/write_owner:allow
2125 2:group@:write_data/append_data/execute:deny
2126 3:group@:read_data:allow
2127 4:everyone@:write_data/append_data/write_xattr/execute/write_attributes
2128 /write_acl/write_owner:deny
2129 5:everyone@:read_data/read_xattr/read_attributes/read_acl/synchronize
2130 :allow
2131 .fi
2132 .in -2
2133 .sp
2135 .LP
2136 \fBExample 18 \fRReplacing a Specific POSIX-draft ACL on a UFS File
2137 .sp
2138 .LP
2139 Consider the following ACL.
2141 .sp
2142 .in +2
2143 .nf
2144 $ ls -v file.4
2145 -rw-r--r--+ 1 marks staff 0 Oct 9 16:21 file.4
2146 0:user::rw-
2147 1:user:lp:rwx #effective:r--
2148 2:group::r-- #effective:r--
2149 3:mask:r--
2150 4:other:r--
2151 .fi
2152 .in -2
2153 .sp
2155 .sp
2156 .LP
2157 Now, change the permission on \fBlp\fR from \fBrwx\fR to \fBr--\fR:
2159 .sp
2160 .in +2
2161 .nf
2162 $ chmod A1=user:lp:r-- file.4
2164 $ ls -v file
2165 -rw-r--r--+ 1 marks staff 0 Oct 9 16:21 file.4
2166 0:user::rw-
2167 1:user:lp:r-- #effective:r--
2168 2:group::r-- #effective:r--
2169 3:mask:r--
2170 4:other:r--
2171 .fi
2172 .in -2
2173 .sp
2175 .LP
2176 \fBExample 19 \fRSetting ACL Inheritance Flags on a ZFS File
2177 .sp
2178 .LP
2179 You can only set inheritance flags on ZFS files. When setting ACLs on
2180 directories, several inheritance flags can be optionally set.
2182 .sp
2183 .LP
2184 Suppose you have an ACL entry for user \fBlp\fR that you want to be inherited
2185 to newly created files in a directory. First, you need to create an
2186 inheritable ACL entry on the directory:
2188 .sp
2189 .in +2
2190 .nf
2191 $ chmod A+user:lp:read_data:file_inherit:allow test.dir
2192 $ ls -dv test.dir
2193 drwxr-xr-x+ 2 marks staff 2 Aug 23 09:08 test.dir/
2194 0:user:lp:read_data:file_inherit:allow
2195 1:owner@::deny
2196 2:owner@:list_directory/read_data/add_file/write_data/add_subdirectory
2197 /append_data/write_xattr/execute/write_attributes/write_acl
2198 /write_owner:allow
2199 3:group@:add_file/write_data/add_subdirectory/append_data:deny
2200 4:group@:list_directory/read_data/execute:allow
2201 5:everyone@:add_file/write_data/add_subdirectory/append_data/write_xattr
2202 /write_attributes/write_acl/write_owner:deny
2203 6:everyone@:list_directory/read_data/read_xattr/execute/read_attributes
2204 /read_acl/synchronize:allow
2205 .fi
2206 .in -2
2207 .sp
2209 .sp
2210 .LP
2211 The \fBlp\fR entry is inherited to newly created files in the directory
2212 \fBtest.dir\fR.
2214 .sp
2215 .in +2
2216 .nf
2217 $ touch test.dir/file.test
2218 $ ls -v test.dir/file.test
2219 -rw-r--r--+ 1 marks staff 0 Oct 9 16:29 test.dir/file.test
2220 0:user:lp::deny
2221 1:user:lp:read_data:allow
2222 2:owner@:execute:deny
2223 3:owner@:read_data/write_data/append_data/write_xattr/
2224 write_attributes/write_acl/write_owner:allow
2225 4:group@:write_data/append_data/execute:deny
2226 5:group@:read_data:allow
2227 6:everyone@:write_data/append_data/write_xattr/execute/
2228 write_attributes/write_acl/write_owner:deny
2229 7:everyone@:read_data/read_xattr/read_attributes/read_acl/
2230 synchronize:allow
2231 .fi
2232 .in -2
2233 .sp
2235 .sp
2236 .LP
2237 The user \fBlp\fR entry is inherited to the newly created file. Multiple
2238 combinations of the inheritance flags can be specified. For example, if you
2239 wanted the \fBlp\fR entry to also be inherited to directories, then the
2240 following command can be used:
2242 .sp
2243 .in +2
2244 .nf
2245 $ chmod A+user:lp:read_data:file_inherit/\e
2246 dir_inherit:allow test.dir
2247 .fi
2248 .in -2
2249 .sp
2251 .LP
2252 \fBExample 20 \fRReplacing System Attributes of a ZFS File
2253 .sp
2254 .LP
2255 The following examples replace system attributes of a ZFS file:
2257 .sp
2258 .in +2
2259 .nf
2260 $ chmod S=v{archive,hidden,readonly,system,appendonly,\e
2261 nonodump,immutable,noav_modified,noav_quarantined,\e
2262 nounlink,nooffline,nosparse} file1
2263 .fi
2264 .in -2
2265 .sp
2267 .sp
2268 .LP
2269 or
2271 .sp
2272 .in +2
2273 .nf
2274 $ chmod S=c{AHRSaiu} file1
2275 .fi
2276 .in -2
2277 .sp
2279 .sp
2280 .LP
2281 or
2283 .sp
2284 .in +2
2285 .nf
2286 $ chmod S=c{AHRSa-i--u--} file1
2287 .fi
2288 .in -2
2289 .sp
2291 .sp
2292 .LP
2293 or
2295 .sp
2296 .in +2
2297 .nf
2298 $ chmod S=cAHRSaiu file1
2299 .fi
2300 .in -2
2301 .sp
2303 .sp
2304 .LP
2305 or
2307 .sp
2308 .in +2
2309 .nf
2310 $ chmod -@ '..' S=cAHRSaiu file1
2311 .fi
2312 .in -2
2313 .sp
2315 .sp
2316 .LP
2317 Assuming appropriate privileges, this results in the following system
2318 attributes of \fBfile1\fR being set: \fBarchive\fR, \fBhidden\fR,
2319 \fBreadonly\fR, \fBsystem\fR, \fBappendonly\fR, \fBimmutable\fR, and
2320 \fBnounlink\fR. Assuming appropriate privileges, the following system
2321 attributes of \fBfile1\fR are cleared: \fBnodump\fR, \fBav_modified\fR,
2322 \fBav_quarantined\fR, \fBoffline\fR, and \fBsparse\fR.
2324 .LP
2325 \fBExample 21 \fRClearing All System Attributes of a ZFS File
2326 .sp
2327 .LP
2328 The following examples clears all system attributes of a ZFS file:
2330 .sp
2331 .in +2
2332 .nf
2333 $ chmod S-a file1
2334 .fi
2335 .in -2
2336 .sp
2338 .sp
2339 .LP
2340 or
2342 .sp
2343 .in +2
2344 .nf
2345 $ chmod -@ '..' S-a file1
2346 .fi
2347 .in -2
2348 .sp
2350 .sp
2351 .LP
2352 Assuming appropriate privileges, all boolean read-write system attributes are
2353 cleared on \fBfile1\fR.
2355 .LP
2356 \fBExample 22 \fRSetting a System Attribute of a Named Attribute File of a ZFS
2357 File
2358 .sp
2359 .LP
2360 The following example sets a system attribute of a named attribute file of a
2361 ZFS file, but not of the file itself:
2363 .sp
2364 .in +2
2365 .nf
2366 $ chmod -@ myattr S+vhidden file1
2367 .fi
2368 .in -2
2369 .sp
2371 .sp
2372 .LP
2373 This results in the hidden system attribute being set for the named attribute
2374 file \fBmyattr\fR of \fBfile1\fR, but not the file itself.
2376 .LP
2377 \fBExample 23 \fRSetting a System Attribute of All Named Attribute File of a
2378 ZFS File
2379 .sp
2380 .LP
2381 The following example sets a system attribute of all named attribute files of a
2382 ZFS file, but not of the file itself:
2384 .sp
2385 .in +2
2386 .nf
2387 $ chmod -@ '*' S+a file1
2388 .fi
2389 .in -2
2390 .sp
2392 .LP
2393 \fBExample 24 \fRSetting a System Attribute of All Named Attribute Files of a
2394 ZFS File
2395 .sp
2396 .LP
2397 The following example sets a system attribute of all named attribute files of a
2398 ZFS file, as well as of the file itself:
2400 .sp
2401 .in +2
2402 .nf
2403 $ chmod -@ '..' -@ '*' S+vhidden file1
2404 .fi
2405 .in -2
2406 .sp
2408 .sp
2409 .LP
2410 This results in the hidden system attribute being set for all named attribute
2411 files of \fBfile1\fR, as well as the file itself.
2413 .LP
2414 \fBExample 25 \fRRecursively Descending Through a Directory Hierarchy
2415 .sp
2416 .LP
2417 The following example recursively descends through a directory hierarchy, and
2418 sets all system attributes of all named attribute files, the ZFS file operands,
2419 as well as of the directory itself:
2421 .sp
2422 .in +2
2423 .nf
2424 $ chmod -R -@ '..' -@ '*' S+a directory1
2425 .fi
2426 .in -2
2427 .sp
2429 .sp
2430 .LP
2431 This results in the hidden system attribute being set for all named attribute
2432 files of all regular files and directories within the directory hierarchy of
2433 \fBdirectory1\fR, as well as of \fBdirectory1\fR itself.
2435 .LP
2436 \fBExample 26 \fRSetting the \fBhidden\fR and \fBsystem\fR System Attributes of
2437 a ZFS File
2438 .sp
2439 .LP
2440 The following examples set the \fBhidden\fR and \fBsystem\fR system attributes
2441 of a ZFS file:
2443 .sp
2444 .in +2
2445 .nf
2446 $ chmod S+cHS file1
2447 .fi
2448 .in -2
2449 .sp
2451 .sp
2452 .LP
2453 or
2455 .sp
2456 .in +2
2457 .nf
2458 $ chmod S+vhidden,+vsystem file1
2459 .fi
2460 .in -2
2461 .sp
2463 .sp
2464 .LP
2465 or
2467 .sp
2468 .in +2
2469 .nf
2470 $ chmod S+v{hidden,system} file1
2471 .fi
2472 .in -2
2473 .sp
2475 .sp
2476 .LP
2477 or
2479 .sp
2480 .in +2
2481 .nf
2482 $ chmod S+c{-H-S--------} file1
2483 .fi
2484 .in -2
2485 .sp
2487 .sp
2488 .LP
2489 or
2491 .sp
2492 .in +2
2493 .nf
2494 $ chmod S-v{nohidden,nosystem} file1
2495 .fi
2496 .in -2
2497 .sp
2499 .sp
2500 .LP
2501 or
2503 .sp
2504 .in +2
2505 .nf
2506 $ chmod S-v{hidden,system},+v{hidden,system} file1
2507 .fi
2508 .in -2
2509 .sp
2511 .LP
2512 \fBExample 27 \fRClearing All System Attributes of a ZFS File
2513 .sp
2514 .LP
2515 The following example clears all system attributes of a ZFS file:
2517 .sp
2518 .in +2
2519 .nf
2520 $ chmod S-a file1
2521 .fi
2522 .in -2
2523 .sp
2525 .sp
2526 .LP
2527 or
2529 .sp
2530 .in +2
2531 .nf
2532 $ chmod S=v{} file1
2533 .fi
2534 .in -2
2535 .sp
2537 .sp
2538 .LP
2539 In the following two examples, the last attribute operation specified takes
2540 precedence.
2542 .sp
2543 .LP
2544 In this example, the replacement attribute name list (\fB{}\fR) clears all
2545 system attributes for \fBfile1\fR:
2547 .sp
2548 .in +2
2549 .nf
2550 $ chmod S+cHS,=v{} file1
2551 .fi
2552 .in -2
2553 .sp
2555 .sp
2556 .LP
2557 In this example, the clear attributes operation (\fB-a\fR) clears all system
2558 attributes of \fBfile1\fR:
2560 .sp
2561 .in +2
2562 .nf
2563 $ chmod S+vhidden,+vsystem,-a file1
2564 .fi
2565 .in -2
2566 .sp
2568 .LP
2569 \fBExample 28 \fRSetting the Values of All Boolean read-write System Attributes
2570 of a File
2571 .sp
2572 .LP
2573 The following example sets the values of all boolean read-write system
2574 attributes of a file to the same as the boolean read-write system attributes of
2575 another file:
2577 .sp
2578 .in +2
2579 .nf
2580 $ chmod S=v`ls -/v file1|sed -n '2s/.*{/{/p'` file2
2581 .fi
2582 .in -2
2583 .sp
2585 .sp
2586 .LP
2587 Assuming appropriate privileges and that \fBfile1\fR and \fBfile2\fR have the
2588 same supported system attributes, all system attributes of \fBfile1\fR that are
2589 set are also set on \fBfile2\fR. All system attributes of \fBfile1\fR that are
2590 cleared are also cleared on \fBfile2\fR.
2592 .SH ENVIRONMENT VARIABLES
2593 .LP
2594 See \fBenviron\fR(5) for descriptions of the following environment variables
2595 that affect the execution of \fBchmod\fR: \fBLANG\fR, \fBLC_ALL\fR,
2596 \fBLC_CTYPE\fR, \fBLC_MESSAGES\fR, and \fBNLSPATH\fR.
2597 .SH EXIT STATUS
2598 .LP
2599 The following exit values are returned:
2600 .sp
2601 .ne 2
2602 .na
2603 \fB\fB0\fR\fR
2604 .ad
2605 .RS 6n
2606 Successful completion.
2607 .RE
2609 .sp
2610 .ne 2
2611 .na
2612 \fB\fB>0\fR\fR
2613 .ad
2614 .RS 6n
2615 An error occurred.
2616 .RE
2618 .SH ATTRIBUTES
2619 .LP
2620 See \fBattributes\fR(5) for descriptions of the following attributes:
2621 .sp
2623 .sp
2624 .TS
2625 box;
2626 c | c
2627 l | l .
2628 ATTRIBUTE TYPE ATTRIBUTE VALUE
2629 _
2630 CSI Enabled
2631 _
2632 Interface Stability Committed
2633 .TE
2635 .SH SEE ALSO
2636 .LP
2637 \fBgetfacl\fR(1), \fBls\fR(1), \fBsetfacl\fR(1), \fBchmod\fR(2),
2638 \fBfgetattr\fR(3C), \fBacl\fR(5), \fBattributes\fR(5), \fBenviron\fR(5),
2639 \fBfsattr\fR(5), \fBlargefile\fR(5), \fBstandards\fR(5)
2640 .SH NOTES
2641 .LP
2642 Absolute changes do not work for the set-group-\fBID\fR bit of a directory. You
2643 must use \fBg+s\fR or \fBg-s\fR.
2644 .sp
2645 .LP
2646 \fBchmod\fR permits you to produce useless modes so long as they are not
2647 illegal (for instance, making a text file executable). \fBchmod\fR does not
2648 check the file type to see if mandatory locking is meaningful.
2649 .sp
2650 .LP
2651 If the filesystem is mounted with the \fInosuid\fR option, \fIsetuid\fR
2652 execution is not allowed.
2653 .sp
2654 .LP
2655 If you use \fBchmod\fR to change the file group owner permissions on a file
2656 with \fBACL\fR entries, both the file group owner permissions and the \fBACL\fR
2657 mask are changed to the new permissions. Be aware that the new \fBACL\fR mask
2658 permissions can change the effective permissions for additional users and
2659 groups who have \fBACL\fR entries on the file. Use the \fBgetfacl\fR(1) or
2660 \fBls\fR(1) command to make sure the appropriate permissions are set for all
2661 \fBACL\fR entries.