/usr/bin/smbcacls

Usage: smbcacls //server1/share1 filename
ACLs look like: 'ACL:user:[ALLOWED|DENIED]/flags/permissions'
  -D, --delete=ACL                             Delete an acl
  -M, --modify=ACL                             Modify an acl
  -a, --add=ACL                                Add an acl
  -S, --set=ACLS                               Set acls
  -C, --chown=USERNAME                         Change ownership of a file
  -G, --chgrp=GROUPNAME                        Change group ownership of a file
  -I, --inherit=STRING                         Inherit allow|remove|copy
      --propagate-inheritance                  Supports propagation of
                                               inheritable ACE(s) when used in
                                               conjunction with add, delete,
                                               set or modify
      --save=STRING                            stores the DACLs in sddl format
                                               of the specified file or folder
                                               for later use with restore.
                                               SACLS, owner or integrity
                                               labels are not stored
      --restore=STRING                         applies the stored DACLS to
                                               files in directory.
      --recurse                                indicates the operation is
                                               performed on directory and all
                                               files/directories below. (only
                                               applies to save option)
      --numeric                                Don't resolve sids or masks to
                                               names
      --sddl                                   Output and input acls in sddl
                                               format
      --query-security-info=INT                The security-info flags for
                                               queries
      --set-security-info=INT                  The security-info flags for
                                               modifications
  -t, --test-args                              Test arguments
      --domain-sid=SID                         Domain SID for sddl
  -x, --maximum-access                         Query maximum permissions

Help options:
  -?, --help                                   Show this help message
      --usage                                  Display brief usage message

Common Samba options:
  -d, --debuglevel=DEBUGLEVEL                  Set debug level
      --debug-stdout                           Send debug output to standard
                                               output
  -s, --configfile=CONFIGFILE                  Use alternative configuration
                                               file
      --option=name=value                      Set smb.conf option from
                                               command line
  -l, --log-basename=LOGFILEBASE               Basename for log/debug files
      --leak-report                            enable talloc leak reporting on
                                               exit
      --leak-report-full                       enable full talloc leak
                                               reporting on exit

Connection options:
  -R, --name-resolve=NAME-RESOLVE-ORDER        Use these name resolution
                                               services only
  -O, --socket-options=SOCKETOPTIONS           socket options to use
  -m, --max-protocol=MAXPROTOCOL               Set max protocol level
  -n, --netbiosname=NETBIOSNAME                Primary netbios name
      --netbios-scope=SCOPE                    Use this Netbios scope
  -W, --workgroup=WORKGROUP                    Set the workgroup name
      --realm=REALM                            Set the realm name

Credential options:
  -U, --user=[DOMAIN/]USERNAME[%PASSWORD]      Set the network username
  -N, --no-pass                                Don't ask for a password
      --password=STRING                        Password
      --pw-nt-hash                             The supplied password is the NT
                                               hash
  -A, --authentication-file=FILE               Get the credentials from a file
  -P, --machine-pass                           Use stored machine account
                                               password
      --simple-bind-dn=DN                      DN to use for a simple bind
      --use-kerberos=desired|required|off      Use Kerberos authentication
      --use-krb5-ccache=CCACHE                 Credentials cache location for
                                               Kerberos
      --use-winbind-ccache                     Use the winbind ccache for
                                               authentication
      --client-protection=sign|encrypt|off     Configure used protection for
                                               client connections

Deprecated legacy options:
  -k, --kerberos                               DEPRECATED: Migrate to
                                               --use-kerberos

Version options:
  -V, --version                                Print version