Copying ACLs Between Directories

Copying ACLs Between Directories
	Chapter 4. Protecting Your Directories and Files

The fs copyacl command copies a source directory's ACL to one or more destination directories. It does not affect the source ACL at all, but changes each destination ACL as follows:

If an entry on the source ACL does not exist on the destination ACL, the command copies it to the destination ACL.
If an entry on the destination ACL does not also exist on the source ACL, the command does not remove it unless you include the -clear flag, which overwrites the destination ACL completely.
If an entry is on both ACLs, the command changes the destination ACL entry to match the source ACL entry.

To copy an ACL, you must have the l permission on the source ACL and the a permission on each destination ACL. If you identify the source directory by naming a file in it, you must also have the r permission on the source ACL. To display the permissions you have on the two directories, use the fs listacl command as described in Displaying an ACL.

Note for AFS/DFS Migration Toolkit users: If the machine on which you issue the fs copyacl command is configured for access to a DCE cell's DFS filespace via the AFS/DFS Migration Toolkit, you can use the command to copy ACLs between DFS files and directories also. The command includes -id and -if flags for altering a DFS directory's Initial Container and Initial Object ACLs as well as its regular ACL; for details, ask your system administrator. You cannot copy ACLs between AFS and DFS directories, because they use different ACL formats. The fs command interpreter ignores the -id and -if flags if you include them when copying AFS ACLs.

To Copy an ACL Between Directories

Issue the fs copyacl command to copy a source ACL to the ACL on one or more destination directories.

   % fs copyacl -fromdir <source directory> -todir <destination directory>⁺  \
                [-clear]

where

co: Is the shortest acceptable abbreviation for copyacl.
-fromdir: Names the source directory from which to copy the ACL. Partial pathnames are interpreted relative to the current working directory. If this argument names a file, the ACL is copied from its directory.
-todir: Names each destination directory to which to copy the source ACL. Partial pathnames are interpreted relative to the current working directory. Filenames are not acceptable.
-clear: Completely overwrites each destination directory's ACL with the source ACL.

Example: Copying an ACL from One Directory to Another

In this example, user terry copies the ACL from her home directory (the current working directory) to its plans subdirectory. She begins by displaying both ACLs.

   % fs listacl . plans
   Access list for . is
   Normal rights:
      terry rlidwka
      pat rlidwk
      jones rl
   Access list for plans is
   Normal rights:
      terry rlidwka
      pat rl
      smith rl

  % fs copyacl -from . -to plans

   % fs listacl . plans
   Access list for . is
   Normal rights:
      terry rlidwka
      pat rlidwk
      jones rl
   Access list for plans is
   Normal rights:
      terry rlidwka
      pat rlidwk
      jones rl
      smith rl


Completely Replacing an ACL		How AFS Uses the UNIX Mode Bits