Directory ACEs Example

Explains how to set access control expressions for directories.

For example, suppose the following diagram depicts the (command-line) sequence of directory Access Control Expression (ACE) settings for user u2:

As shown in the preceding illustration, in:

Step 1:

User u2 is granted access to read directory and sampleDir, while all other directory/file ACEs are not specified.

After the command runs, user u2 has permissions to list the contents of the directory. The POSIX mode bits for listing the contents of the directory (r) is set to u2 for owner/users.

There is no change in ACEs or POSIX mode bits for all other (file- and directory-level) access types.

Step 2:

User u2 is granted permission only to add and delete child directories, while all other directory/file ACEs are not specified.

After the command runs, user u2 has permissions to create and delete child directories. The POSIX mode bit for writing (w) to the directory for owner/user is set to u2 because user u2 is granted access for both (addchild and deletechild) access types.

If user u2 creates child directories, by default, they inherit the ACE settings of the parent directory.

There is no change in ACEs or POSIX mode bits for all other (file- and directory-level) access types.

Step 3:

User u2’s permissions are modified to grant access to read and write to files in the directory. User u2's permissions for adding and deleting child directories are removed (using the negation operator). All other directory/file ACEs are not specified.

After the command runs, user u2 can read and write to files in the directory, but user u2 can no longer add and delete child directories. The POSIX mode bits for directory write access (w) is set to 0 for owner/user.

Although at the directory level, user u2 has permissions to read and write to files in the directory for existing files, the file level ACEs or the POSIX mode bits for the file are used to determine access. By default, user u2 gets read and write permissions to all new files created under the directory. If user u2 creates new files under the directory, the files inherit the file ACEs from the parent directory by default, and the POSIX mode bits for read (r) and write (w) access are set to u2 for owner/user.

There is no change in ACEs or POSIX mode bits for all other (lookupdir and executefile) access types.