Changing and displaying file-level ACLs

About file-level ACLs

Permission settings for files and directories are stored in file-level ACLs. These ACLs follow the Windows 2000 NTFS security model. For files that have NTFS-style security, CIFS users can set and display file-level ACLs from their PC. All files in an NTFS-style qtree and some files in a mixed qtree may have NTFS-style security.

Files in a FAT file system do not have ACLs; they use UNIX permissions. When viewed from a CIFS client, files without ACLs will not display the Security tab in the file Properties window.

The file system (FAT or NTFS) for a given resource depends upon the filer authentication method and qtree style for that resource.

qtree style and authentication method	File system
UNIX-style qtree and all authentication methods	FAT
Mixed or NTFS-style qtree and /etc/passwd authentication	FAT
Mixed or NTFS-style qtree and domain or workgroup authentication	NTFS

Permission types in a file-level ACL

Data ONTAP supports all permission types supported by Windows file-level ACLs.

Setting and displaying a file-level ACL

To set and display a file-level ACL, complete the following steps.

Step	Action
1	From the Windows desktop, right-click a file and select Properties from the pop-up menu.
2	Click the Security tab. Note Depending on authentication method and qtree style, the Security tab may not be present.
3	Click Permissions. Example The following figure illustrates changing the file-level ACL for a folder in the test2 share by adding the user LAB\aimee to the ACL.

Step

Action

From the Windows desktop, right-click a file and select Properties from the pop-up menu.

Click the Security tab.

Note
Depending on authentication method and qtree style, the Security tab may not be present.

Click Permissions.

Example

The following figure illustrates changing the file-level ACL for a folder in the test2 share by adding the user LAB\aimee to the ACL.

Limitations of Windows NT4 clients on shares that support wide symbolic links

On an NT4 client, if you right-click a file that is located in a share that supports wide symbolic links and select Properties, no Security tab is displayed. You can set security using a security tool such as cacls. Alternatively, you can either access files from a Windows 2000 client or access files using shares that don't support wide symbolic links. You can have two different shares on the same directory, one that supports wide symbolic links and one that does not, and use the share that does not support wide symbolic links when setting security.