---
name: "nfs4_editfacl"
section: "1"
platform: "linux"
package: "nfs4-acl-tools"
version: "0.3.3-3+b1"
release: "Debian 11 (Bullseye)"
platforms: ["linux"]
url: "https://new.carta.tech/nfs4_setfacl"
---

# nfs4\_editfacl(1)

manipulate NFSv4 file/directory access control lists

Part of [nfs4\_setfacl(1)](/nfs4_setfacl/1.md).

## NAME

nfs4\_setfacl, nfs4\_editfacl - manipulate NFSv4 file/directory access control lists

## SYNOPSIS

**nfs4\_setfacl** \[OPTIONS\] COMMAND  *file*...\
 **nfs4\_editfacl** \[OPTIONS\]  *file*...

## DESCRIPTION

**nfs4\_setfacl** manipulates the NFSv4 Access Control List (ACL) of one or more  *files* (or directories), provided they are on a mounted NFSv4 filesystem which supports ACLs.

**nfs4\_editfacl** is equivalent to  **nfs4\_setfacl -e**.

Refer to the [**nfs4\_acl**(5)](/nfs4_acl/5.md) manpage for information about NFSv4 ACL terminology and syntax.

### COMMANDS

- **-a** *acl\_spec* \[*index*\]

  add the ACEs from *acl\_spec* to *file*'s ACL. ACEs are inserted starting at the *index*th position (DEFAULT: 1) of *file*'s ACL.

- **-A** *acl\_file* \[*index*\]

  add the ACEs from the acl\_spec in *acl\_file* to *file*'s ACL. ACEs are inserted starting at the *index*th position (DEFAULT: 1) of *file*'s ACL.

- **-x** *acl\_spec \| index*

  delete ACEs matched from *acl\_spec* - or delete the  *index*th ACE - from  *file*'s ACL.  Note that the ordering of the ACEs in *acl\_spec* does not matter.

- **-X** *acl\_file*

  delete ACEs matched from the acl\_spec in *acl\_file* from *file*'s ACL. Note that the ordering of the ACEs in the acl\_spec does not matter.

- **-s** *acl\_spec*

  set *file*'s ACL to *acl\_spec*.

- **-S** *acl\_file*

  set *file*'s ACL to the acl\_spec in *acl\_file*.

- **-e**, **--edit**

  edit *file*'s ACL in the editor defined in the EDITOR environment variable (DEFAULT:  [**vi**(1)](/vi/1.md)) and set the resulting ACL upon a clean exit, assuming changes made in the editor were saved.  Note that if multiple *files* are specified, the editor will be serially invoked once per *file*.

- **-m** *from\_ace to\_ace*

  modify *file*'s ACL in-place by replacing *from\_ace* with *to\_ace*.

- **-?**, **-h**, **--help**

  display help text and exit.

- **--version**

  display this program's version and exit.

NOTE: if '-' is given as the *acl\_file* with the **-A**/**-X**/**-S** flags, the acl\_spec will be read from stdin.

### OPTIONS

- **-R**, **--recursive**

  recursively apply to a directory's files and subdirectories.  Similar to  [**setfacl**(1)](/setfacl/1.md), the default behavior is to follow symlinks given on the command line and to skip symlinks encountered while recursing through directories.

- **-L**, **--logical**

  in conjunction with **-R**/**--recursive**, a logical walk follows all symbolic links.

- **-P**, **--physical**

  in conjunction with **-R**/**--recursive**, a physical walk skips all symbolic links.

- **--test**

  display results of  **COMMAND**, but do not save changes.

## PERMISSIONS ALIASES

With  **nfs4\_setfacl**, one can use simple abbreviations ("aliases") to express generic "read" (**R**), generic "write" (**W**), and generic "execute" (**X**) *permissions*, familiar from the POSIX mode bits used by, e.g.,  [**chmod**(1)](/chmod/1.md). To use these aliases, one can put them in the *permissions* field of an NFSv4 ACE and **nfs4\_setfacl** will convert them: an **R** is expanded to **rntcy**, a **W** is expanded to **watTNcCy** (with  **D** added to directory ACEs), and an **X** is expanded to **xtcy**. Please refer to the [**nfs4\_acl**(5)](/nfs4_acl/5.md) manpage for information on specific NFSv4 ACE *permissions*.

For example, if one wanted to grant generic "read" and "write" access on a file, the NFSv4 *permissions* field would normally contain something like **rwatTnNcCy**. Instead, one might use aliases to accomplish the same goal with **RW**.

The two *permissions* not included in any of the aliases are **d** (delete) and  **o** (write-owner).  However, they can still be used: e.g., a  *permissions* field consisting of **Wdo** expresses generic "write" access as well as the ability to delete and change ownership.

## EXAMPLES

Assume that the file \`foo' has the following NFSv4 ACL for the following examples:

```
A::OWNER@:rwatTnNcCy
D::OWNER@:x
A:g:GROUP@:rtncy
D:g:GROUP@:waxTC
A::EVERYONE@:rtncy
D::EVERYONE@:waxTC
```

- \-

  add ACE granting \`alice@nfsdomain.org' generic "read" and "execute" access (defaults to prepending ACE to ACL):\
  \
   	$ nfs4\_setfacl -a A::alice@nfsdomain.org:rxtncy foo

- \-

  add the same ACE as above, but using aliases:\
  \
   	$ nfs4\_setfacl -a A::alice@nfsdomain.org:RX foo

- \-

  edit existing ACL in a text editor and set modified ACL on clean save/exit:\
  \
   	$ nfs4\_setfacl -e foo

- \-

  set ACL (overwrites original) to contents of a *spec\_file* named \`newacl.txt':\
  \
   	$ nfs4\_setfacl -S newacl.txt foo

- \-

  recursively set the ACLs of all files and subdirectories in the current directory, skipping all symlinks encountered, to the ACL contained in the *spec\_file* named \`newacl.txt':\
  \
   	$ nfs4\_setfacl -R -P -S newacl.txt \*

- \-

  delete the first ACE, but only print the resulting ACL (does not save changes):\
  \
   	$ nfs4\_setfacl --test -x 1 foo

- \-

  delete the last two ACEs above:\
  \
   	$ nfs4\_setfacl -x "A::EVERYONE@rtncy, D::EVERYONE@:waxTC" foo

- \-

  modify (in-place) the second ACE above:\
  \
   	$ nfs4\_setfacl -m D::OWNER@:x  D::OWNER@:xo foo

- \-

  set ACLs of \`bar' and \`frobaz' to ACL of \`foo':\
  \
   	$ nfs4\_getfacl foo \| nfs4\_setfacl -S - bar frobaz

## AUTHORS

**nfs4\_setfacl** was written by people at CITI, the Center for Information Technology Integration (*http://www.citi.umich.edu*). This manpage was written by David Richter.

## CONTACT

Please send bug reports, feature requests, and comments to  \<*nfsv4@linux-nfs.org*\>.

## SEE ALSO

[**nfs4\_getfacl**(1)](/nfs4_getfacl/1.md), [**nfs4\_acl**(5)](/nfs4_acl/5.md), *RFC3530* (NFSv4.0), NFSv4.1 Minor Version Draft.