How share-level access control lists work

About share-level ACLs

A share-level ACL (access control list) consists of a list of access control entries (ACEs). Each ACE contains a user or group name and a set of permissions that determines user or group access to the share.

A share-level ACL only restricts access to files in the share; it never grants more access than the file-level ACLs.

When a CIFS user tries to access a share, Data ONTAP always checks the share-level ACL to determine whether access should be granted, regardless of the security style of the qtree containing the share.

Permission styles and types in a share-level ACL

When changing a share-level ACL, you can specify Windows permissions or UNIX-style permissions.

Note
If you use UNIX-style permissions, you cannot use Server Manager to manage the share-level ACL.

The following table describes the permissions you can specify.

Permission style	Permissions
Windows permissions	No Access Read Change Full Control
UNIX permissions	Combinations of `r`, `w`, `x`, and `-`.