---
name: "setcifsacl"
section: "1"
platform: "linux"
package: "cifs-utils"
version: "7.9-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/setcifsacl"
---

# setcifsacl(1)

Userspace helper to alter components of a security descriptor for Common Internet File System (CIFS)

## Name

setcifsacl - Userspace helper to alter components of a security descriptor for Common Internet File System (CIFS)

## SYNOPSIS

setcifsacl \[-v\|-U\|-a\|-A\|-D\|-M\|-S\|-o\|-g\] "{one or more ACEs or a SID}" {file system object}

## DESCRIPTION

This tool is part of the cifs-utils suite.

**setcifsacl** is a userspace helper program for the Linux CIFS client file system. It is intended to alter an ACL or set owner/group SID of a security descriptor for a file system object. Whether a security descriptor to be set is applied or not is determined by the CIFS/SMB server.

This program uses a plugin to handle the mapping of user and group names to SIDs. */etc/cifs-utils/idmap-plugin* should be a symlink that points to the correct plugin to use.

## OPTIONS

- **-h**

  Print usage message and exit.

- **-v**

  Print version number and exit.

- **-U**

  Apply ACE editing actions (-a, -D, -M, -S) to SACL (aUdit ACL). The actions are appliend to DACL if -U is not specified.

- **-a**

  Add one or more ACEs to an ACL of a security descriptor.  An ACE is added even if the same ACE exists in the ACL.

- **-A**

  Add one or more ACEs to the ACL of a security descriptor, while maintaining the preferred order of the ACEs. The preferred order of ACEs are described in the following documentation: \<https://docs.microsoft.com/en-us/windows/win32/secauthz/order-of-aces-in-a-dacl\>

- **-D**

  Delete one or more ACEs from an ACL of a security descriptor.  Entire ACE has to match in an existing ACL for the listed ACEs to be deleted.

- **-M**

  Modify one or more ACEs from an ACL of a security descriptor.  SID and type are used to match for existing ACEs to be modified with the list of ACEs specified.

- **-S**

  Set an ACL of security descriptor with the list of ACEs Existing ACL is replaced entirely with the specified ACEs.

- **-o**

  Set owner SID to one specified as a command line argument.

- **-g**

  Set group SID to one specified as a command line argument.

  The owner/group SID can be specified as a name or a raw SID value. Every ACE entry starts with "ACL:" One or more ACEs are specified within double quotes.  Multiple ACEs are separated by a comma.

  Following fields of a DACL ACE can be modified with possible values:

  - •

    **SID** - Either a name or a raw SID value.

  - •

    **type** - ALLOWED (0x0), DENIED (0x1), OBJECT\_ALLOWED (0x5), OBJECT\_DENIED (0x6)

  - •

    **flags** - OBJECT\_INHERIT\_FLAG (OI or 0x1), CONTAINER\_INHERIT\_FLAG (CI or 0x2), NO\_PROPAGATE\_INHERIT\_FLAG (NI or 0x4), INHERIT\_ONLY\_FLAG (IO or 0x8), INHERITED\_ACE\_FLAG (IA or 0x10) or a combination/OR of these values.

  - •

    **mask**  - Either one of FULL, CHANGE, READ, a combination of R W X D P O, or a hex value.

  Following fields of a SACL ACE can be modified with possible values:

  - •

    **SID** - Either a name or a raw SID value.

  - •

    **type** - AUDIT (0x2), AUDIT\_OBJECT (0x7), AUDIT\_CALLBACK (0xD), AUDIT\_CALLBACK\_OBJECT (0xF), MANDATORY\_LABEL (0x11), RESOURCE\_ATTRIBUTE (0x12), SCOPED\_POLICY\_ID (0x13)

  - •

    **flags** - SUCCESSFULL\_ACCESS (SA or 0x40), FAILED\_ACCESS (FA or 0x80)

  - •

    **mask**  - Either one of FULL, CHANGE, READ, a combination of R W X D P O, or a hex value.

## EXAMPLES

### Add an ACE

setcifsacl -a "ACL:CIFSTESTDOM\\user2:DENIED/0x1/D" \<file\_name\>

setcifsacl -a "ACL:CIFSTESTDOM\\user1:ALLOWED/OI\|CI\|NI/D" \<file\_name\>

setcifsacl -U -a "ACL:CIFSTESTDOM\\user1:AUDIT/SA/D" \<file\_name\>

### Add an ACE and reorder ACL

setcifsacl -A "ACL:CIFSTESTDOMuser3:ALLOWED/OI/FULL" \<file\_name\> setcifsacl -A "ACL:CIFSTESTDOMuser2:DENIED/0x1/D" \<file\_name\> setcifsacl -A "ACL:CIFSTESTDOMuser1:ALLOWED/OI\|CI\|NI/D" \<file\_name\>

After setting above mentioned ACEs, below is output of getcifsacl: ACL:CIFSTESTDOMuser2:DENIED/0x1/D ACL:CIFSTESTDOMuser3:ALLOWED/OI/FULL ACL:CIFSTESTDOMuser1:ALLOWED/OI\|CI\|NI/D

### Delete an ACE

setcifsacl -D "ACL:S-1-1-0:0x1/OI/0x1201ff" \<file\_name\>

setcifsacl -U -D "ACL:S-1-1-0:0x2/FA/0xf01ff" \<file\_name\>

### Modify an ACE

setcifsacl -M "ACL:CIFSTESTDOM\\user1:ALLOWED/0x1f/CHANGE" \<file\_name\>

setcifsacl -U -M "ACL:CIFSTESTDOM\\user1:AUDIT\_OBJECT/SA/CHANGE" \<file\_name\>

### Set an ACL

setcifsacl -S "ACL:CIFSTESTDOM\\Administrator:0x0/0x0/FULL,ACL:CIFSTESTDOM\\user2:0x0/0x0/FULL" \<file\_name\>

setcifsacl -U -S "ACL:CIFSTESTDOM\\Administrator:AUDIT/SA/FULL,ACL:CIFSTESTDOM\\user2:0x7/0x80/FULL" \<file\_name\>

### Set owner SID

setcifsacl -o "S-1-5-21-3338130290-3403600371-1423429424-2102" \<file\_name\>

### Set group SID

setcifsacl -g "\<Administrators@BUILTIN\>" \<file\_name\>

## NOTES

Kernel support for getcifsacl/setcifsacl utilities was initially introduced in the 2.6.37 kernel.

## SEE ALSO

[mount.cifs(8)](/mount.cifs/8.md), [getcifsacl(1)](/getcifsacl/1.md)

## AUTHOR

Shirish Pargaonkar wrote the setcifsacl program.

The Linux CIFS Mailing list is the preferred place to ask questions regarding these programs.