Specifications

20 Chapter 1 Overview of File Services
The ACL Use Model
The ACL use model is centered around access control at the folder level, with ACLs
applied to files as the result of inheritance.
Folder-level control defines which users have access to the contents of a folder, and
inheritance defines how a defined set of permissions and rules pass from the container
to the objects within it.
Without use of this model, administration of access control would quickly become a
nightmare: you would have to create and manage ACLs on thousands or millions of
files. In addition, controlling access to files through inheritance frees applications from
having to maintain extended attributes or explicit ACEs when saving a file because the
system automatically applies inherited ACEs to files (see “Explicit and Inherited ACEs”
on page 21 for information about explicit ACEs).
ACLs and Standard Permissions
You can set ACL permissions for files and folders in addition to standard permissions.
See “Rules of Precedence” on page 24 for more information on how Mac OS X Server
uses ACL and standard permissions to determine what users can and cannot do to a
file or folder.
ACL Management
In Mac OS X Server, you can create and manage ACLs in the Access pane of the Sharing
pane of Workgroup Manager, but you can’t do so in the Get Info window in Finder. The
Get Info window, however, will display the logged-in user’s effective permissions. See
“Setting ACL Permissions” on page 34, and “Managing Share Point Access Privileges” on
page 43 for instructions on how to set and manage ACLs.
In addition to Workgroup Manager, you can set and view ACL permissions on both
Mac OS X and Mac OS X Server using the command-line tools ls and chmod. See the
corresponding man pages and the command-line administration guide for more
information.
Using Workgroup Manager, you can define ACLs for share points and folders. As for
files, they get their ACLs through inheritance, as stated earlier.
Supported Volume Formats and Protocols
Only HFS+ provides local file system support for ACLs. In addition, only SMB and AFP
provide network file system support for ACLs in Windows and Apple networks
respectively.