NAME

       setcifsacl  -  Userspace  helper  to  alter  components of a security descriptor for Common Internet File
       System (CIFS)

SYNOPSIS

          setcifsacl [-v|-U|-a|-A|-D|-M|-S|-o|-g] "{one or more ACEs or a SID}" {file system object}

DESCRIPTION

       This tool is part of the cifs-utils suite.

       setcifsacl is a userspace helper program for the Linux CIFS client file system. It is intended  to  alter
       an  ACL  or  set  owner/group  SID  of a security descriptor for a file system object. Whether a security
       descriptor to be set is applied or not is determined by the CIFS/SMB server.

       This  program  uses  a  plugin  to  handle   the   mapping   of   user   and   group   names   to   SIDs.
       /etc/cifs-utils/idmap-plugin should be a symlink that points to the correct plugin to use.

OPTIONS

       -h     Print usage message and exit.

       -v     Print version number and exit.

       -U     Apply  ACE  editing actions (-a, -D, -M, -S) to SACL (aUdit ACL). The actions are appliend to DACL
              if -U is not specified.

       -a     Add one or more ACEs to an ACL of a security descriptor.  An ACE is added even  if  the  same  ACE
              exists in the ACL.

       -A     Add one or more ACEs to the ACL of a security descriptor, while maintaining the preferred order of
              the   ACEs.    The  preferred  order  of  ACEs  are  described  in  the  following  documentation:
              https://docs.microsoft.com/en-us/windows/win32/secauthz/order-of-aces-in-a-dacl

       -D     Delete one or more ACEs from an ACL of a security descriptor.  Entire  ACE  has  to  match  in  an
              existing ACL for the listed ACEs to be deleted.

       -M     Modify  one or more ACEs from an ACL of a security descriptor.  SID and type are used to match for
              existing ACEs to be modified with the list of ACEs specified.

       -S     Set an ACL of security descriptor with the list of ACEs Existing ACL is replaced entirely with the
              specified ACEs.

       -o     Set owner SID to one specified as a command line argument.

       -g     Set group SID to one specified as a command line argument.

              The owner/group SID can be specified as a name or a raw SID value.  Every ACE  entry  starts  with
              "ACL:"  One  or  more  ACEs  are specified within double quotes.  Multiple ACEs are separated by a
              comma.

              Following fields of a DACL ACE can be modified with possible values:

              • SID - Either a name or a raw SID value.

              • type - ALLOWED (0x0), DENIED (0x1), OBJECT_ALLOWED (0x5), OBJECT_DENIED (0x6)

              • flags   -   OBJECT_INHERIT_FLAG   (OI   or   0x1),   CONTAINER_INHERIT_FLAG   (CI    or    0x2),
                NO_PROPAGATE_INHERIT_FLAG  (NI or 0x4), INHERIT_ONLY_FLAG (IO or 0x8), INHERITED_ACE_FLAG (IA or
                0x10) or a combination/OR of these values.

              • mask  - Either one of FULL, CHANGE, READ, a combination of R W X D P O, or a hex value.

              Following fields of a SACL ACE can be modified with possible values:

              • SID - Either a name or a raw SID value.

              • type - AUDIT (0x2),  AUDIT_OBJECT  (0x7),  AUDIT_CALLBACK  (0xD),  AUDIT_CALLBACK_OBJECT  (0xF),
                MANDATORY_LABEL (0x11), RESOURCE_ATTRIBUTE (0x12), SCOPED_POLICY_ID (0x13)

              • flags - SUCCESSFULL_ACCESS (SA or 0x40), FAILED_ACCESS (FA or 0x80)

              • mask  - Either one of FULL, CHANGE, READ, a combination of R W X D P O, or a hex value.

EXAMPLES

   Add an ACE
          setcifsacl -a "ACL:CIFSTESTDOM\user2:DENIED/0x1/D" <file_name>

          setcifsacl -a "ACL:CIFSTESTDOM\user1:ALLOWED/OI|CI|NI/D" <file_name>

          setcifsacl -U -a "ACL:CIFSTESTDOM\user1:AUDIT/SA/D" <file_name>

   Add an ACE and reorder ACL
          setcifsacl      -A      "ACL:CIFSTESTDOMuser3:ALLOWED/OI/FULL"      <file_name>      setcifsacl     -A
          "ACL:CIFSTESTDOMuser2:DENIED/0x1/D"              <file_name>               setcifsacl               -A
          "ACL:CIFSTESTDOMuser1:ALLOWED/OI|CI|NI/D" <file_name>

          After  setting  above mentioned ACEs, below is output of getcifsacl: ACL:CIFSTESTDOMuser2:DENIED/0x1/D
          ACL:CIFSTESTDOMuser3:ALLOWED/OI/FULL ACL:CIFSTESTDOMuser1:ALLOWED/OI|CI|NI/D

   Delete an ACE
          setcifsacl -D "ACL:S-1-1-0:0x1/OI/0x1201ff" <file_name>

          setcifsacl -U -D "ACL:S-1-1-0:0x2/FA/0xf01ff" <file_name>

   Modify an ACE
          setcifsacl -M "ACL:CIFSTESTDOM\user1:ALLOWED/0x1f/CHANGE" <file_name>

          setcifsacl -U -M "ACL:CIFSTESTDOM\user1:AUDIT_OBJECT/SA/CHANGE" <file_name>

   Set an ACL
          setcifsacl     -S      "ACL:CIFSTESTDOM\Administrator:0x0/0x0/FULL,ACL:CIFSTESTDOM\user2:0x0/0x0/FULL"
          <file_name>

          setcifsacl   -U  -S  "ACL:CIFSTESTDOM\Administrator:AUDIT/SA/FULL,ACL:CIFSTESTDOM\user2:0x7/0x80/FULL"
          <file_name>

   Set owner SID
          setcifsacl -o "S-1-5-21-3338130290-3403600371-1423429424-2102" <file_name>

   Set group SID
          setcifsacl -g "Administrators@BUILTIN" <file_name>

NOTES

       Kernel support for getcifsacl/setcifsacl utilities was initially introduced in the 2.6.37 kernel.

SEE ALSO

       mount.cifs(8), getcifsacl(1)

AUTHOR

       Shirish Pargaonkar wrote the setcifsacl program.

       The Linux CIFS Mailing list is the preferred place to ask questions regarding these programs.

                                                                                                   SETCIFSACL(1)