GPFS: Administration and Programming Reference - IRA Home

mmgetacl Command
Parameters
Filename
The path name of the file or directory for which the ACL is to be displayed. If the -d option is
specified, Filename must contain the name of a directory.
Options
-d Specifies that the default ACL of a directory is to be displayed.
-k {nfs4 | posix | native}
nfs4 Always produces an NFS V4 ACL.
posix Always produces a traditional ACL.
native Always shows the ACL in its true form regardless of the file system setting.
-o OutFilename
The path name of a file to which the ACL is to be written.
Exit status
0 Successful completion.
nonzero A failure has occurred.
Security
You must have read access to the directory where the file exists to run the mmgetacl command.
You may issue the mmgetacl command only from a node in the GPFS cluster where the file system is
mounted.
Examples
1. To display the ACL for a file named project2.history, issue this command:
mmgetacl project2.history
The system displays information similar to:
#owner:paul
#group:design
user::rwxc
group::r-x-
other::r-x-
2. This is an example of an NFS V4 ACL displayed using mmgetacl. Each entry consists of three lines
reflecting the greater number of permissions in a text format. An entry is either an allow entry or a
deny entry. An X indicates that the particular permission is selected, a minus sign (–) indicates that is
it not selected. The following access control entry explicitly allows READ, EXECUTE and READ_ATTR
to the staff group on a file:
group:staff:r-x-:allow
(X)READ/LIST (-)WRITE/CREATE (-)MKDIR (-)SYNCHRONIZE (-)READ_ACL (X)READ_ATTR (-)READ_NAMED
(-)DELETE (-)DELETE_CHILD (-)CHOWN (X)EXEC/SEARCH (-)WRITE_ACL (-)WRITE_ATTR (-)WRITE_NAMED
3. This is an example of a directory ACLs, which may include inherit entries (the equivalent of a default
ACL). These do not apply to the directory itself, but instead become the initial ACL for any objects
created within the directory. The following access control entry explicitly denies READ/LIST,
READ_ATTR, and EXEC/SEARCH to the sys group.
group:sys:----:deny:DirInherit
(X)READ/LIST (-)WRITE/CREATE (-)MKDIR (-)SYNCHRONIZE (-)READ_ACL (X)READ_ATTR (-)READ_NAMED
(-)DELETE (-)DELETE_CHILD (-)CHOWN (X)EXEC/SEARCH (-)WRITE_ACL (-)WRITE_ATTR (-)WRITE_NAMED
186 GPFS: Administration and Programming Reference