by Morgan Aldridge morgant@makkintosshu.com
This is a collection of command line tools for working with file ACLs to complement the support built into ls & chmod on Mac OS X, incl.:
findacl-- A wrapper forfindwhich adds ACL-related primaries.chgrpacl-- Change ACEs from one group to another.chusracl-- Change ACEs from one user to another.
Development was sponsored by Small Dog Electronics, Inc.
aclfind is a Mac OS X-specific wrapper to find that adds knowledge of ACLs. In Mac OS X, only ls, chmod, and vim command line utilities know about ACLs, and the latter only enough to preserve them. find is an extremely powerful tool, esp. for finding and adding/changing/removing permissions, but it's not helpful at all when it comes to ACLs, so this utility aims to improve that. It is written in bash, so it's slow, but I may port it to C at some point (or patch find itself?)
The usage of aclfind is identical to find since it's really just a wrapper for it, with the addition of the following primaries. See man find for details.
-noacl
True if the file has no ACL.
-aceuser uname
True if the file has an ACE for the user 'uname'.
-acegroup gname
True if the file has an ACE for the group 'gname'.
-aceperm permission
True if the file has an ACE containing 'permission'. Accepts a comma-delimited list of permissions.
-acelocal
True if the file has a 'local', non-inherited, ACE.
-aceinherited
True if the file has an 'inherited' ACE.
-aceallow
True if the file has an 'allow' ACE.
-acedeny
True if the file has a 'deny' ACE.
-printacl
This prints any matching ACE after the filename, indented by a single space and prepended with the ACE number in the ACL (the same format that `ls` outputs ACEs in).
Note: aclfind does not add any operators, but it also doesn't support operators at the moment and just ANDs them together. This is planned for a future release.
[x] Implement `-noacl`.
[x] Improve `-aceperm` to accept a comma-delimited list of permissions.
[x] Support inherited ACEs.
[ ] Add `-aceallowuser`, `-acedenyuser`, `-aceallowgroup`, `-acedenygroup`, `-aceallowperm`, `-acedenyperm` primaries?
[ ] Override `-exec` so we're performing it _after_ we get results back from `find` (it should never be passed through to `find`).
[ ] Add unit tests.
[ ] Build a proper `find` path to support operators.
chgrpacl is wrapper for findacl which allows you to change ACEs on files & directories from one group to another, much like chgrp lets you change the group for POSIX permissions. This is ideal if you need to replace group ACEs in a complex structure, for example you've had to create a new group in order to change the group's short name.
The usage of chgrpacl is very similar to chgrp with the exception that you must provide the old group name as well as the new group name:
chgrpacl [-R] oldgroup newgroup file
By default, chgrpacl will only change the ACEs for the specified oldgroup for the specified file, but one can use the -R option to change them recursively for all children as well.
chusracl is also a wrapper for findacl which allows you to change ACEs on files & directories from one user to another, much like chown lets you change the owner for POSIX permissions. This is ideal if you need to replace group ACEs in a complex structure, for example you have one user taking on the role (and therefore the permissions of) another user.
The usage of chusracl is very similar to chown with the exception that you must provide the old user name as well as the new user name:
chusracl [-R] olduser newuser file
By default, chusracl will only change the ACEs for the specified olduser for the specified file, but one can use the -R option to change them recursively for all children as well.
- Mac OS X Hints: Script to list all filesystem objects with ACLs
- Stack Overflow: remove an ACL entry for just ONE user in MacOS? oddly difficult
- Apple Source Browser: find
Copyright (c) 2013-2016, Morgan Aldridge. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.