setcifsacl(1) General Commands Manual setcifsacl(1)

# [Name](#Name)

setcifsacl - Userspace helper to alter components of a security descriptor for Common Internet File System (CIFS)

# [SYNOPSIS](#SYNOPSIS)

setcifsacl \[-v|-U|-a|-A|-D|-M|-S|-o|-g] "{one or more ACEs or a SID}" {file system object}

# [DESCRIPTION](#DESCRIPTION)

This tool is part of the cifs-utils suite.

**setcifsacl** is a userspace helper program for the Linux CIFS client file system. It is intended to alter an ACL or set owner/group SID of a security descriptor for a file system object. Whether a security descriptor to be set is applied or not is determined by the CIFS/SMB server.

This program uses a plugin to handle the mapping of user and group names to SIDs. */etc/cifs-utils/idmap-plugin* should be a symlink that points to the correct plugin to use.

# [OPTIONS](#OPTIONS)

[**-h**](#h)

Print usage message and exit.

[**-v**](#v)

Print version number and exit.

[**-U**](#U)

Apply ACE editing actions (-a, -D, -M, -S) to SACL (aUdit ACL). The actions are appliend to DACL if -U is not specified.

[**-a**](#a)

Add one or more ACEs to an ACL of a security descriptor. An ACE is added even if the same ACE exists in the ACL.

[**-A**](#A)

Add one or more ACEs to the ACL of a security descriptor, while maintaining the preferred order of the ACEs. The preferred order of ACEs are described in the following documentation: <https://docs.microsoft.com/en-us/windows/win32/secauthz/order-of-aces-in-a-dacl>

[**-D**](#D)

Delete one or more ACEs from an ACL of a security descriptor. Entire ACE has to match in an existing ACL for the listed ACEs to be deleted.

[**-M**](#M)

Modify one or more ACEs from an ACL of a security descriptor. SID and type are used to match for existing ACEs to be modified with the list of ACEs specified.

[**-S**](#S)

Set an ACL of security descriptor with the list of ACEs Existing ACL is replaced entirely with the specified ACEs.

[**-o**](#o)

Set owner SID to one specified as a command line argument.

[**-g**](#g)

Set group SID to one specified as a command line argument.

The owner/group SID can be specified as a name or a raw SID value. Every ACE entry starts with "ACL:" One or more ACEs are specified within double quotes. Multiple ACEs are separated by a comma.

Following fields of a DACL ACE can be modified with possible values:

- **SID** - Either a name or a raw SID value.
- **type** - ALLOWED (0x0), DENIED (0x1), OBJECT\_ALLOWED (0x5), OBJECT\_DENIED (0x6)
- **flags** - OBJECT\_INHERIT\_FLAG (OI or 0x1), CONTAINER\_INHERIT\_FLAG (CI or 0x2), NO\_PROPAGATE\_INHERIT\_FLAG (NI or 0x4), INHERIT\_ONLY\_FLAG (IO or 0x8), INHERITED\_ACE\_FLAG (IA or 0x10) or a combination/OR of these values.
- **mask** - Either one of FULL, CHANGE, READ, a combination of R W X D P O, or a hex value.

Following fields of a SACL ACE can be modified with possible values:

- **SID** - Either a name or a raw SID value.
- **type** - AUDIT (0x2), AUDIT\_OBJECT (0x7), AUDIT\_CALLBACK (0xD), AUDIT\_CALLBACK\_OBJECT (0xF), MANDATORY\_LABEL (0x11), RESOURCE\_ATTRIBUTE (0x12), SCOPED\_POLICY\_ID (0x13)
- **flags** - SUCCESSFULL\_ACCESS (SA or 0x40), FAILED\_ACCESS (FA or 0x80)
- **mask** - Either one of FULL, CHANGE, READ, a combination of R W X D P O, or a hex value.

# [EXAMPLES](#EXAMPLES)

## [Add an ACE](#Add_an_ACE)

setcifsacl -a "ACL:CIFSTESTDOM\\user2:DENIED/0x1/D" <file\_name>

setcifsacl -a "ACL:CIFSTESTDOM\\user1:ALLOWED/OI|CI|NI/D" <file\_name>

setcifsacl -U -a "ACL:CIFSTESTDOM\\user1:AUDIT/SA/D" <file\_name>

## [Add an ACE and reorder ACL](#Add_an_ACE_and_reorder_ACL)

setcifsacl -A "ACL:CIFSTESTDOMuser3:ALLOWED/OI/FULL" <file\_name> setcifsacl -A "ACL:CIFSTESTDOMuser2:DENIED/0x1/D" <file\_name> setcifsacl -A "ACL:CIFSTESTDOMuser1:ALLOWED/OI|CI|NI/D" <file\_name>

After setting above mentioned ACEs, below is output of getcifsacl: ACL:CIFSTESTDOMuser2:DENIED/0x1/D ACL:CIFSTESTDOMuser3:ALLOWED/OI/FULL ACL:CIFSTESTDOMuser1:ALLOWED/OI|CI|NI/D

## [Delete an ACE](#Delete_an_ACE)

setcifsacl -D "ACL:S-1-1-0:0x1/OI/0x1201ff" <file\_name>

setcifsacl -U -D "ACL:S-1-1-0:0x2/FA/0xf01ff" <file\_name>

## [Modify an ACE](#Modify_an_ACE)

setcifsacl -M "ACL:CIFSTESTDOM\\user1:ALLOWED/0x1f/CHANGE" <file\_name>

setcifsacl -U -M "ACL:CIFSTESTDOM\\user1:AUDIT\_OBJECT/SA/CHANGE" <file\_name>

## [Set an ACL](#Set_an_ACL)

setcifsacl -S "ACL:CIFSTESTDOM\\Administrator:0x0/0x0/FULL,ACL:CIFSTESTDOM\\user2:0x0/0x0/FULL" <file\_name>

setcifsacl -U -S "ACL:CIFSTESTDOM\\Administrator:AUDIT/SA/FULL,ACL:CIFSTESTDOM\\user2:0x7/0x80/FULL" <file\_name>

## [Set owner SID](#Set_owner_SID)

setcifsacl -o "S-1-5-21-3338130290-3403600371-1423429424-2102" <file\_name>

## [Set group SID](#Set_group_SID)

setcifsacl -g "<Administrators@BUILTIN>" <file\_name>

# [NOTES](#NOTES)

Kernel support for getcifsacl/setcifsacl utilities was initially introduced in the 2.6.37 kernel.

# [SEE ALSO](#SEE_ALSO)

[mount.cifs(8)](/man/os/cifs-utils/mount.cifs.8), [getcifsacl(1)](/man/os/cifs-utils/getcifsacl.1)

# [AUTHOR](#AUTHOR)

Shirish Pargaonkar wrote the setcifsacl program.

The Linux CIFS Mailing list is the preferred place to ask questions regarding these programs.

---

Document: setcifsacl(1) from cifs-utils 7.9-r0 (Chainguard OS)
Source: git://git.samba.org/cifs-utils.git