Editing Solaris 10 Associate (section)

== Access Control Lists (ACL) ==

ACL allows owner of file or directory to grant or deny specific user access using owner, group, & other

=== ACL commands & descriptions ===

{| border="1" cellspacing="0" cellpadding="5" align="center"
! ACL command examples
! description
|-
| <code>getfacl -a filename_or_directoryname</code>
| shows name, owner, group, & ACL entries for file & directory
|-
| <code>setfacl -m acl_entries filename_or_directoryname</code>
| modifies ACL entries on file & directory
|-
| <code>setfacl -s acl_entries filename_or_directoryname</code>
| substitutes new ACL entries on file & directory
|-
| <code>setfacl -d acl_entries filename_or_directoryname</code>
|
* deletes one or more ACL entries on file & directory
* unable to delete file owner, group owner, or ACL mask)
|-
| <code>setfacl -r [-m,-s] filename_or_directoryname</code>
| recalculates ACL mask based on ACL entries, when used with -m or -s option
|}

=== Viewing ACL entries ===

ACL entry syntax:
* entry-type:[UID or GID]:permission
** entry-type specifies the scope of the file or directory permissions to owner, owner's group, specific users, additional groups, or ACL mask
** UID or GID specifies the UID or GID
** permissions specifies permissions for entry-type using r,w,x,-, or octal values 0-7

{| border="1" cellspacing="0" cellpadding="5" align="center"
! entry type
! description
|-
| u::permission
| permissions for file owner
|-
| g::permission
| permission for owner's group
|-
| o:permission
| permissions for users other than owner or member of owner's group
|-
|
* u:UID:permission or
* u:username:permission
| permissions for specific user that must exist in /etc/passwd file
|-
|
* g:GID:permission or
* g:groupname:permission
| permissions for specific group that must exist in /etc/group file
|-
| m:permission
|
* ACL mask that sets maximum effective permissions allowed for all specified users & groups
* does not impact owner or other
|}

==== Determining Non-trivial ACL entries ====

Use <code>ls -l</code> command to determine if a file or directory has a non-trivial ACL entry

The presence of a plus sign (+) at end of permission field indicates that file or directory has an ACL entry

==== Determining trivial ACL entries ====

Use <code>getfacl</code> command to display list of trivial ACL entries for file or directory


<insert examples of getfacl and setfacl>

==== Configure ACLs using File Manager GUI ====

<add examples & screenshots>