Home / server / Questions / 275838
Accepted
mralexgray
Asked: 2011-06-02 03:06:11 +0800 CST

Catch-all ACL attributes via CLI for Mac OS X?

  • 772

It's nice and all that one can "go crazy" adding and subtracting ACL's from files/folders till the cows come home... but when doing it from the command line, say for example..

$ chmod +a# 1 "admin deny delete" foo 
$ ls -lde foo 
 drwxr-xr-x + 2 apl apl 68 Jul 19 18:32 foo 
 0: group:admin allow delete 
 1: group:admin deny delete 
 2: user:tony allow delete

Is there an "easier" syntax that allows for "ALL" type scenarios? Since there are a total of 2^13 * 12 = 98,304 different access rights you can define it would be great if you could for example state...

$ chmod +a "staff allow all" foo

But as far as I can tell, it ain't possible. Any extended-attribute gurus out there know of any tricks?

mac-osx permissions user-management terminal access-control-list

1 Answers

  1. Best Answer

    I'm not sure if this helps, but since you can have more than one permission per ACL, you could use a couple of environment variables (e.g. in your .profile) to make it easier. Assuming your default shell is bash:

    export FILE_ALL="read,write,append,execute,delete,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown"
export DIR_ALL="list,search,add_file,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown"

    Then when you need to grant permissions:

    $ chmod +a "group:admin allow $FILE_ALL" foo
    • 2