Red Hat Summit1.10. Managing ACLs on an SMB share using smbcacls
The smbcacls utility can list, set, and delete ACLs of files and directories stored on an SMB share.
You can use smbcacls to manage file system ACLs:
- On a local or remote Samba server that uses advanced Windows ACLs or POSIX ACLs
- On Red Hat Enterprise Linux to remotely manage ACLs on a share hosted on Windows
1.10.1. Access control entries
Access Control Entries (ACEs) define permissions, inheritance, and access rights for users and groups on files and directories. Understand ACE format and components to interpret and manage file system access using ACLs, especially in SMB environments.
Each ACL entry of a file system object contains Access ACE in the following format:
security_principal:access_right/inheritance_information/permissions例1.3 Access control entries
If the AD\Domain Users group has Modify permissions that apply to This folder, subfolders, and files on Windows, the ACL contains the following ACE:
AD\Domain Users:ALLOWED/OI|CI/CHANGEAn ACE contains the following parts:
- Security principal
- The security principal is the user, group, or SID the permissions in the ACL are applied to.
- Access right
-
Defines if access to an object is granted or denied. The value can be
ALLOWEDorDENIED. - Inheritance information
The following values exist:
Expand 表1.1 Inheritance settings Value Description Maps to OIObject Inherit
This folder and files
CIContainer Inherit
This folder and subfolders
IOInherit Only
The ACE does not apply to the current file or directory
IDInherited
The ACE was inherited from the parent directory
Additionally, the values can be combined as follows:
Expand 表1.2 Inheritance settings combinations Value combinations Maps to the Windows Applies tosettingOI|CIThis folder, subfolders, and files
OI|CI|IOSubfolders and files only
CI|IOSubfolders only
OI|IOFiles only
- Permissions
This value can be either a hex value that represents one or more Windows permissions or an
smbcaclsalias:A hex value that represents one or more Windows permissions.
The following table displays the advanced Windows permissions and their corresponding value in hex format:
Expand 表1.3 Windows permissions and their corresponding smbcacls value in hex format Windows permissions Hex values Full control
0x001F01FFTraverse folder / execute file
0x00100020List folder / read data
0x00100001Read attributes
0x00100080Read extended attributes
0x00100008Create files / write data
0x00100002Create folders / append data
0x00100004Write attributes
0x00100100Write extended attributes
0x00100010Delete subfolders and files
0x00100040Delete
0x00110000Read permissions
0x00120000Change permissions
0x00140000Take ownership
0x00180000Multiple permissions can be combined as a single hex value using the bit-wise
ORoperation. For details, see ACE mask calculation.An
smbcaclsalias. The following table displays the available aliases:Expand 表1.4 Existing smbcacls aliases and their corresponding Windows permission smbcaclsaliasMaps to Windows permission RRead
READRead & execute
WSpecial:
- Create files / write data
- Create folders / append data
- Write attributes
- Write extended attributes
- Read permissions
DDelete
PChange permissions
OTake ownership
XTraverse / execute
CHANGEModify
FULLFull control
注記You can combine single-letter aliases when you set permissions. For example, you can set
RDto apply the Windows permissionReadandDelete. However, you can neither combine multiple non-single-letter aliases nor combine aliases and hex values.
1.10.2. Displaying ACLs using smbcacls
To display ACLs on an SMB share, use the smbcacls utility. If you run smbcacls without any operation parameter, such as --add, the utility displays the ACLs of a file system object.
Procedure
For example, to list the ACLs of the root directory of the
//server/exampleshare:# smbcacls //server/example / -U "DOMAIN\administrator" Enter DOMAIN\administrator's password: REVISION:1 CONTROL:SR|PD|DI|DP OWNER:AD\Administrators GROUP:AD\Domain Users ACL:AD\Administrator:ALLOWED/OI|CI/FULL ACL:AD\Domain Users:ALLOWED/OI|CI/CHANGE ACL:AD\Domain Guests:ALLOWED/OI|CI/0x00100021The output of the command displays:
-
REVISION: The internal Windows NT ACL revision of the security descriptor -
CONTROL: Security descriptor control -
OWNER: Name or SID of the security descriptor’s owner -
GROUP: Name or SID of the security descriptor’s group -
ACLentries. For details, see Access control entries.
1.10.3. ACE mask calculation
In most situations, when you add or update an ACE, you use the smbcacls aliases listed in Existing smbcacls aliases and their corresponding Windows permission.
However, if you want to set advanced Windows permissions as listed in Windows permissions and their corresponding smbcacls value in hex format, you must use the bit-wise OR operation to calculate the correct value. You can use the following shell command to calculate the value:
# echo $(printf '0x%X' $(( hex_value_1 | hex_value_2 | ... )))例1.4 Calculating an ACE Mask
You want to set the following permissions:
- Traverse folder / execute file (0x00100020)
- List folder / read data (0x00100001)
- Read attributes (0x00100080)
To calculate the hex value for the previous permissions, enter:
# echo $(printf '0x%X' $(( 0x00100020 | 0x00100001 | 0x00100080 )))
0x1000A1Use the returned value when you set or update an ACE.
1.10.4. Adding, updating, and removing an ACL using smbcacls
Depending on the parameter you pass to the smbcacls utility, you can add, update, and remove ACLs from a file or directory.
Adding an ACL
To add an ACL to the root of the //server/example share that grants CHANGE permissions for This folder, subfolders, and files to the AD\Domain Users group:
# smbcacls //server/example / -U "DOMAIN\administrator --add ACL:"AD\Domain Users":ALLOWED/OI|CI/CHANGEUpdating an ACL
Updating an ACL is similar to adding a new ACL. You update an ACL by overriding the ACL using the --modify parameter with an existing security principal. If smbcacls finds the security principal in the ACL list, the utility updates the permissions. Otherwise the command fails with an error:
ACL for SID principal_name not found
For example, to update the permissions of the AD\Domain Users group and set them to READ for This folder, subfolders, and files:
# smbcacls //server/example / -U "DOMAIN\administrator --modify ACL:"AD\Domain Users":ALLOWED/OI|CI/READDeleting an ACL
To delete an ACL, pass the --delete parameter with the exact ACL to the smbcacls utility. For example:
# smbcacls //server/example / -U "DOMAIN\administrator --delete ACL:"AD\Domain Users":ALLOWED/OI|CI/READ
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}