z/OS V1R9.0 UNIX System Services Command ... - Christian Grothoff

Examples
–x EntryOrFile
Deletes the extended ACL entries specified by EntryOrFile. EntryOrFile is a
string of ACL entries typed directly on the command line. If an ACL entry
does not exist for the user or group specified, then you will not get an error.
If the permissions field is provided in EntryOrFile, then it is ignored when
this option is processed. Users cannot delete the base ACL entries (file
owner, owning group, and others). If base ACL entries are specified with
this option, they are ignored. Deleting an extended ACL entry does not
necessarily have the same effect as removing all the permissions from an
entry.
–X EntryOrFile
Deletes the extended ACL entries specified by EntryOrFile. EntryOrFile is a
file containing ACL entries. If an ACL entry does not exist for the user or
group specified, then you will not get an error. If EntryOrFile is –, then
entries are read from stdin. If the permissions field is provided in
EntryOrFile, then it is ignored when this option is processed. Users cannot
delete the base ACL entries (file owner, owning group, and others). If base
ACL entries are specified with this option, they are ignored. Deleting an
extended ACL entry does not necessarily have the same effect as removing
all the permissions from an entry.
When you use setfacl to add, change and delete ACL entries, all deletion
operations are performed first. In other words, deletion operations are processed
before any change or add operations.
1. To set (replace) the current access ACL for file foo, giving only user Billy read
and execute access:
setfacl -s user::rwx,group::---,other::---,user:billy:r-x foo
This may change the permission bits of the file.
2. To modify the current access ACL for file foo to contain an extended ACL entry
for group cartoons, giving that group read access:
setfacl -m group:cartoons:+r foo
3. To set (replace) the current access and directory default ACLs for directory
Haunted so that users user1 and user2 have read and search permissions,
while the group thegang has read permissions:
setfacl -s "u::rwx,g::---,o::---, \
user:user1:r-x,group:thegang:r--,user:user2:r-x, \
d:user:user1:r-x,d:group:thegang:r--,d:user:user2:r-x" Haunted
4. To copy the ACL from file foo such that the file bar will have the same ACL:
getfacl foo | setfacl -S - bar
5. To delete all of the extended ACL entries for user user3 for all files and
directories in the current directory:
setfacl -x user:user3,d:user:user3,f:user:user3 *
6. To delete all of the extended ACL entries for all files and directories in the
current working directory:
setfacl -D e *
7. To change a directory’s access ACL so that that user1 has read, write, and
execute access for all files in the Haunted directory:
setfacl -m user:user1:rwx Haunted
setfacl
Chapter 2. Shell command descriptions 547