4

In OS X, if you want to view the ACL information on a file, you can do so with the -e option of `ls.

$ ls -lde app/cache
drwxrwxr-x+ 7 alanstorm  staff  238 Apr  1 10:02 app/cache
 0: user:alanstorm allow add_file,delete,add_subdirectory,file_inherit,directory_inherit
 1: user:root allow add_file,delete,add_subdirectory,file_inherit,directory_inherit
 2: user:_www allow add_file,delete,add_subdirectory,file_inherit,directory_inherit

What's the format of the individual ACE lines? Is this documented anywhere? I couldn't find anything in the chmod or ls man pages, and most internet articles did a lot of "and there's your ACL/ACE entries" hand waving once they taught you the -e option.

I can start to guess at the meanings — the last column is obviously the individual permissions, the first is either a user or group, etc., but I don't know what the meaning of allow/deny is in OS X ACL talk, and I don't know if the 0, 1, 2 carry any semantic meaning, and (most importantly) I don't know what else I don't know. For example, there's an inherited column that shows up if a file's inherited permissions

0: user:alanstorm allow add_file,delete,add_subdirectory,file_inherit,directory_inherit 
vs.
0: user:alanstorm inherited allow add_file,delete,add_subdirectory,file_inherit,directory_inherit

This screws up straight whitespace parsing, and I'd like to know if there's other places where stuff like this pops up.

If anyone here could help clear up the individual questions I have about column 1 and column 3, or more generally describe the format, I'd appreciated it.

Long time unix user here, but I'm not really up to speed on ACL stuff. Bitmasks, chmod, pry from my cold dead hand, etc.

Alana Storm
  • 1,413
  • 3
  • 14
  • 17
  • [This](https://developer.apple.com/library/Mac/documentation/Darwin/Reference/ManPages/man1/chmod.1.html) may help. But it should be better referenced from `ls(1)` ... – 0xC0000022L Jun 05 '14 at 17:19
  • @0xC0000022L I'm not sure I follow that — was there supposed to be a link with your comment? – Alana Storm Jun 05 '14 at 17:43
  • is the link "behind" `This` in my first command not visible for you? Points to `chmod(1)` for Darwin/MacOSX. – 0xC0000022L Jun 05 '14 at 18:57
  • Ah, thanks. No underline or color shift on This meant it didn't scan as a link to me. – Alana Storm Jun 05 '14 at 19:38
  • 1
    I had the same questions. This document may help you: FileSystemProgrammingGuide in Apple's site. I'm not sure if the link is working. Perhaps you need to be registered as Developer. Read page 97. https://developer.apple.com/library/ios/documentation/FileManagement/Conceptual/FileSystemProgrammingGuide/FileSystemProgrammingGuide.pdf – Anastasia Pi Oct 16 '15 at 07:46

1 Answers1

0

0 1 2 are the ACE in order of evaluation, and the rules behind it are human readble in my opinion.

However this is a RTFM answer, the acl format is described in man ls on OS X.

Setting of acl is done through chmod on OSX; see man chmod (ACL format also described there).

Jeff Schaller
  • 66,199
  • 35
  • 114
  • 250
Stéphane Gasparini
  • 1