NAME

       setcifsacl  -  Userspace  helper  to  alter components of a security descriptor for Common
       Internet File System (CIFS)

SYNOPSIS

          setcifsacl [-v|-U|-a|-A|-D|-M|-S|-o|-g] "{one or more ACEs  or  a  SID}"  {file  system
          object}

DESCRIPTION

       This tool is part of the cifs-utils suite.

       setcifsacl  is  a  userspace  helper  program for the Linux CIFS client file system. It is
       intended to alter an ACL or set owner/group SID of a security descriptor for a file system
       object.  Whether  a  security  descriptor to be set is applied or not is determined by the
       CIFS/SMB server.

       This program uses a plugin to handle  the  mapping  of  user  and  group  names  to  SIDs.
       /etc/cifs-utils/idmap-plugin should be a symlink that points to the correct plugin to use.

OPTIONS

       -h     Print usage message and exit.

       -v     Print version number and exit.

       -U     Apply  ACE  editing  actions  (-a, -D, -M, -S) to SACL (aUdit ACL). The actions are
              appliend to DACL if -U is not specified.

       -a     Add one or more ACEs to an ACL of a security descriptor.  An ACE is added  even  if
              the same ACE exists in the ACL.

       -A     Add  one  or  more  ACEs to the ACL of a security descriptor, while maintaining the
              preferred order of the ACEs.  The preferred order of  ACEs  are  described  in  the
              following                                                            documentation:
              https://docs.microsoft.com/en-us/windows/win32/secauthz/order-of-aces-in-a-dacl

       -D     Delete one or more ACEs from an ACL of a security descriptor.  Entire  ACE  has  to
              match in an existing ACL for the listed ACEs to be deleted.

       -M     Modify  one  or  more  ACEs from an ACL of a security descriptor.  SID and type are
              used to match for existing ACEs to be modified with the list of ACEs specified.

       -S     Set an ACL of security descriptor with the list of ACEs Existing  ACL  is  replaced
              entirely with the specified ACEs.

       -o     Set owner SID to one specified as a command line argument.

       -g     Set group SID to one specified as a command line argument.

              The owner/group SID can be specified as a name or a raw SID value.  Every ACE entry
              starts with "ACL:" One or more ACEs are specified within double  quotes.   Multiple
              ACEs are separated by a comma.

              Following fields of a DACL ACE can be modified with possible values:

              • SID - Either a name or a raw SID value.

              • type - ALLOWED (0x0), DENIED (0x1), OBJECT_ALLOWED (0x5), OBJECT_DENIED (0x6)

              • flags  -  OBJECT_INHERIT_FLAG  (OI  or  0x1), CONTAINER_INHERIT_FLAG (CI or 0x2),
                NO_PROPAGATE_INHERIT_FLAG  (NI  or   0x4),   INHERIT_ONLY_FLAG   (IO   or   0x8),
                INHERITED_ACE_FLAG (IA or 0x10) or a combination/OR of these values.

              • mask   - Either one of FULL, CHANGE, READ, a combination of R W X D P O, or a hex
                value.

              Following fields of a SACL ACE can be modified with possible values:

              • SID - Either a name or a raw SID value.

              • type   -    AUDIT    (0x2),    AUDIT_OBJECT    (0x7),    AUDIT_CALLBACK    (0xD),
                AUDIT_CALLBACK_OBJECT  (0xF),  MANDATORY_LABEL (0x11), RESOURCE_ATTRIBUTE (0x12),
                SCOPED_POLICY_ID (0x13)

              • flags - SUCCESSFULL_ACCESS (SA or 0x40), FAILED_ACCESS (FA or 0x80)

              • mask  - Either one of FULL, CHANGE, READ, a combination of R W X D P O, or a  hex
                value.

EXAMPLES

   Add an ACE
          setcifsacl -a "ACL:CIFSTESTDOM\user2:DENIED/0x1/D" <file_name>

          setcifsacl -a "ACL:CIFSTESTDOM\user1:ALLOWED/OI|CI|NI/D" <file_name>

          setcifsacl -U -a "ACL:CIFSTESTDOM\user1:AUDIT/SA/D" <file_name>

   Add an ACE and reorder ACL
          setcifsacl   -A   "ACL:CIFSTESTDOMuser3:ALLOWED/OI/FULL"   <file_name>   setcifsacl  -A
          "ACL:CIFSTESTDOMuser2:DENIED/0x1/D"         <file_name>          setcifsacl          -A
          "ACL:CIFSTESTDOMuser1:ALLOWED/OI|CI|NI/D" <file_name>

          After    setting    above    mentioned   ACEs,   below   is   output   of   getcifsacl:
          ACL:CIFSTESTDOMuser2:DENIED/0x1/D                  ACL:CIFSTESTDOMuser3:ALLOWED/OI/FULL
          ACL:CIFSTESTDOMuser1:ALLOWED/OI|CI|NI/D

   Delete an ACE
          setcifsacl -D "ACL:S-1-1-0:0x1/OI/0x1201ff" <file_name>

          setcifsacl -U -D "ACL:S-1-1-0:0x2/FA/0xf01ff" <file_name>

   Modify an ACE
          setcifsacl -M "ACL:CIFSTESTDOM\user1:ALLOWED/0x1f/CHANGE" <file_name>

          setcifsacl -U -M "ACL:CIFSTESTDOM\user1:AUDIT_OBJECT/SA/CHANGE" <file_name>

   Set an ACL
          setcifsacl                                                                           -S
          "ACL:CIFSTESTDOM\Administrator:0x0/0x0/FULL,ACL:CIFSTESTDOM\user2:0x0/0x0/FULL"
          <file_name>

          setcifsacl                                     -U                                    -S
          "ACL:CIFSTESTDOM\Administrator:AUDIT/SA/FULL,ACL:CIFSTESTDOM\user2:0x7/0x80/FULL"
          <file_name>

   Set owner SID
          setcifsacl -o "S-1-5-21-3338130290-3403600371-1423429424-2102" <file_name>

   Set group SID
          setcifsacl -g "Administrators@BUILTIN" <file_name>

NOTES

       Kernel  support for getcifsacl/setcifsacl utilities was initially introduced in the 2.6.37
       kernel.

SEE ALSO

       mount.cifs(8), getcifsacl(1)

AUTHOR

       Shirish Pargaonkar wrote the setcifsacl program.

       The Linux CIFS Mailing list is the  preferred  place  to  ask  questions  regarding  these
       programs.

                                                                                    SETCIFSACL(1)