1 .\" Copyright (c) 1989, 1990, 1993, 1994
2 .\" The Regents of the University of California. All rights reserved.
4 .\" This code is derived from software contributed to Berkeley by
5 .\" the Institute of Electrical and Electronics Engineers, Inc.
7 .\" Redistribution and use in source and binary forms, with or without
8 .\" modification, are permitted provided that the following conditions
10 .\" 1. Redistributions of source code must retain the above copyright
11 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\" 3. All advertising materials mentioning features or use of this software
16 .\" must display the following acknowledgement:
17 .\" This product includes software developed by the University of
18 .\" California, Berkeley and its contributors.
19 .\" 4. Neither the name of the University nor the names of its contributors
20 .\" may be used to endorse or promote products derived from this software
21 .\" without specific prior written permission.
23 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 .\" @(#)chmod.1 8.4 (Berkeley) 3/31/94
36 .\" $FreeBSD: src/bin/chmod/chmod.1,v 1.33 2002/10/01 20:32:59 trhodes Exp $
43 .Nd change file modes or Access Control Lists
47 .Op Fl R Op Fl H | L | P
52 .Op Fl R Op Fl H | L | P
58 .Op Fl R Op Fl H | L | P
63 .Op Fl R Op Fl H | L | P
69 utility modifies the file mode bits of the listed files
72 operand. It may also be used to modify the Access Control
73 Lists (ACLs) associated with the listed files.
75 The generic options are as follows:
80 option is specified, symbolic links on the command line are followed.
81 (Symbolic links encountered in the tree traversal are not followed by
86 option is specified, all symbolic links are followed.
90 option is specified, no symbolic links are followed.
93 Change the modes of the file hierarchies rooted in the files
94 instead of just the files themselves.
96 Do not display a diagnostic message if
98 could not modify the mode for
103 to be verbose, showing filenames as the mode is modified.
106 flag is specified more than once, the old and new modes of the file
107 will also be printed, in both octal and symbolic notation.
115 options are ignored unless the
118 In addition, these options override each other and the
119 command's actions are determined by the last one specified.
121 Only the owner of a file or the super-user is permitted to change
126 Modes may be absolute or symbolic.
127 An absolute mode is an octal number constructed from the sum of
128 one or more of the following values:
130 .Bl -tag -width 6n -compact -offset indent
132 (the set-user-ID-on-execution bit) Executable files with this bit set
133 will run with effective uid set to the uid of the file owner.
134 Directories with the set-user-id bit set will force all files and
135 sub-directories created in them to be owned by the directory owner
136 and not by the uid of the creating process, if the underlying file
137 system supports this feature: see
144 (the set-group-ID-on-execution bit) Executable files with this bit set
145 will run with effective gid set to the gid of the file owner.
155 Allow write by owner.
157 For files, allow execution by owner.
158 For directories, allow the owner to
159 search in the directory.
161 Allow read by group members.
163 Allow write by group members.
165 For files, allow execution by group members.
166 For directories, allow
167 group members to search in the directory.
169 Allow read by others.
171 Allow write by others.
173 For files, allow execution by others.
174 For directories allow others to
175 search in the directory.
178 For example, the absolute mode that permits read, write and execute by
179 the owner, read and execute by group members, read and execute by
180 others, and no set-uid or set-gid behaviour is 755
181 (400+200+100+040+010+004+001).
183 The symbolic mode is described by the following grammar:
184 .Bd -literal -offset indent
185 mode ::= clause [, clause ...]
186 clause ::= [who ...] [action ...] action
187 action ::= op [perm ...]
188 who ::= a | u | g | o
190 perm ::= r | s | t | w | x | X | u | g | o
195 symbols ``u'', ``g'', and ``o'' specify the user, group, and other parts
196 of the mode bits, respectively.
199 symbol ``a'' is equivalent to ``ugo''.
203 symbols represent the portions of the mode bits as follows:
205 .Bl -tag -width Ds -compact -offset indent
209 The set-user-ID-on-execution and set-group-ID-on-execution bits.
215 The execute/search bits.
217 The execute/search bits if the file is a directory or any of the
218 execute/search bits are set in the original (unmodified) mode.
221 symbol ``X'' are only meaningful in conjunction with the
223 symbol ``+'', and are ignored in all other cases.
225 The user permission bits in the original mode of the file.
227 The group permission bits in the original mode of the file.
229 The other permission bits in the original mode of the file.
234 symbols represent the operation performed, as follows:
237 If no value is supplied for
239 the ``+'' operation has no effect.
240 If no value is supplied for
242 each permission bit specified in
244 for which the corresponding bit in the file mode creation mask
246 Otherwise, the mode bits represented by the specified
252 If no value is supplied for
254 the ``\-'' operation has no effect.
255 If no value is supplied for
257 each permission bit specified in
259 for which the corresponding bit in the file mode creation mask
260 is clear, is cleared.
261 Otherwise, the mode bits represented by the specified
267 The mode bits specified by the
269 value are cleared, or, if no who value is specified, the owner, group
270 and other mode bits are cleared.
271 Then, if no value is supplied for
273 each permission bit specified in
275 for which the corresponding bit in the file mode creation mask
277 Otherwise, the mode bits represented by the specified
286 specifies one or more operations to be performed on the mode
287 bits, and each operation is applied to the mode bits in the
290 Operations upon the other permissions only (specified by the symbol
291 ``o'' by itself), in combination with the
293 symbols ``s'' or ``t'', are ignored.
294 .Sh EXAMPLES OF VALID MODES
295 .Bl -tag -width "u=rwx,go=u-w" -compact
297 make a file readable by anyone and writable by the owner only.
300 deny write permission to group and others.
303 set the read and write permissions to the usual defaults, but
304 retain any execute permissions that are currently set.
307 make a directory or file searchable/executable by everyone if it is
308 already searchable/executable by anyone.
313 make a file readable/executable by everyone and writable by the owner only.
316 clear all mode bits for group and others.
319 set the group bits equal to the user bits, but clear the group write bit.
321 .Sh ACL MANIPULATION OPTIONS
322 ACLs are manipulated using extensions to the symbolic mode
323 grammar. Each file has one ACL, containing an ordered list of entries.
324 Each entry refers to a user or group, and grants or denies a set of
327 The following permissions are applicable to all filesystem objects:
328 .Bl -tag -width 6n -compact -offset indent
330 Delete the item. Deletion may be granted by either this permission
331 on an object or the delete_child right on the containing directory.
333 Read an objects basic attributes. This is implicitly granted if
334 the object can be looked up and not explicitly denied.
336 Write an object's basic attributes.
338 Read extended attributes.
340 Write extended attributes.
342 Read an object's extended security information (ACL).
344 Write an object's security information (ownership, mode, ACL).
346 Change an object's ownership.
349 The following permissions are applicable to directories:
350 .Bl -tag -width 6n -compact -offset indent
354 Look up files by name.
360 Delete a contained object. See the file delete permission above.
363 The following permissions are applicable to non-directory filesystem objects:
364 .Bl -tag -width 6n -compact -offset indent
370 Open for writing, but in a fashion that only allows writes into areas of
371 the file not previously written.
373 Execute the file as a script or program.
376 ACL inheritance is controlled with the following permissions words, which
377 may only be applied to directories:
378 .Bl -tag -width 6n -compact -offset indent
381 .It directory_inherit
382 Inherit to directories.
384 This flag is only relevant to entries inherited by subdirectories; it
385 causes the directory_inherit flag to be cleared in the entry that is
386 inherited, preventing further nested subdirectories from also
387 inheriting the entry.
389 The entry is inherited by created items but not considered when processing
393 The ACL manipulation options are as follows:
396 The +a mode parses a new ACL entry from the next argument on
397 the commandline and inserts it into the canonical location in the
398 ACL. If the supplied entry refers to an identity already listed, the
399 two entries are combined.
403 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
404 # chmod +a "admin allow write" file1
406 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
409 # chmod +a "guest deny read" file1
411 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
415 # chmod +a "admin allow delete" file1
417 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
420 2: admin allow write,delete
422 The +a mode strives to maintain correct canonical form for the ACL.
428 By default, chmod adds entries to the top of the local deny and local
429 allow lists. Inherited entries are added by using the +ai mode.
433 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
436 2: admin allow write,delete
437 3: juser inherited deny delete
438 4: admin inherited allow delete
439 5: backup inherited deny read
440 6: admin inherited allow write-security
441 # chmod +ai "others allow write" file1
443 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
446 2: admin allow write,delete
447 3: juser inherited deny delete
448 4: others inherited allow read
449 5: admin inherited allow delete
450 6: backup inherited deny read
451 7: admin inherited allow write-security
453 When a specific ordering is required, the exact location at which an
454 entry will be inserted is specified with the +a# mode.
458 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
462 # chmod +a# 2 "others deny read" file1
464 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
470 The +ai# mode may be used to insert inherited entries at a specific
471 location. Note that these modes allow non-canonical ACL ordering to
474 The -a mode is used to delete ACL entries. All entries exactly
475 matching the supplied entry will be deleted. If the entry lists a
476 subset of rights granted by an entry, only the rights listed are
477 removed. Entries may also be deleted by index using the -a# mode.
481 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
484 2: admin allow write,delete
487 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
489 1: admin allow write,delete
490 # chmod -a "admin allow write" file1
492 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
494 1: admin allow delete
496 Inheritance is not considered when processing the -a mode; rights and
497 entries will be removed regardless of their inherited state.
499 Individual entries are rewritten using the =a# mode.
503 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
505 1: admin allow delete
506 # chmod =a# 1 "admin allow write,chown"
508 -rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
510 1: admin allow write,chown
512 This mode may not be used to add new entries.
514 Reads the ACL information from stdin, as a sequential list
515 of ACEs, separated by newlines. If the information parses correctly,
516 the existing information is replaced.
518 Returns false if any of the named files have ACLs in non-canonical order.
520 Removes the 'inherited' bit from all entries in the named file(s) ACLs.
522 Removes all inherited entries from the named file(s) ACL(s).
527 option is non-standard and its use in scripts is not recommended.
543 utility is expected to be
545 compatible with the exception of the
549 which is not included in that standard.