Changing and displaying a share-level ACL

Reason for changing a share-level ACL

After you create a share, by default, the share-level ACL gives Read access to the special group named Everyone. That is, all users in the domain and all trusted domains have read-only access to the share. You would change the share-level ACL if you want to give users more or fewer privileges to the share than they are allocated when the share is created.

Methods of changing a share-level ACL

To change a share-level ACL, use one of the following methods:

From a Windows client, use the MMC. Remember these guidelines if you use this method:
- You can specify only Windows permissions.
- The user and group names specified must be Windows names.
- The share-level ACL must not have UNIX-style permissions.
From the Data ONTAP command line, you can use the cifs access command. Remember these guidelines if you use this method:
- You can specify either Windows permissions or UNIX-style permissions.
- The user and group names can be Windows or UNIX names.
  If the storage system is authenticated by the /etc/passwd file, the user or group name in the ACL is assumed to be a UNIX name. If the storage system is authenticated by a domain controller, the name is at first assumed to be a Windows name, but if the name is not found on the domain controller, the storage system tries to look up the name in the UNIX name database.

Displaying and changing an ACL with the MMC

To display and change an ACL with the MMC, complete the following steps.

Step	Action
1	Connect to the storage system using the MMC as described in Connecting to the storage system using MMC.
2	Perform the following actions to display an ACL of a share: Click Computer Management, if it is not selected already. Double-click System Tools > Shared Folders > Shares. In the right panel, right-click the share whose ACL you want to display. Select Properties from the drop-down menu. Click the Share Permissions tab. Result: The ACL of the share is displayed.
3	If you want to change the ACL for a user, select the group or user from the "Group or user names" box and change the permissions in the "Permissions for group or user name" box, as shown in the following example.

Step

Action

Connect to the storage system using the MMC as described in Connecting to the storage system using MMC.

Perform the following actions to display an ACL of a share:

Click Computer Management, if it is not selected already.
Double-click System Tools > Shared Folders > Shares.
In the right panel, right-click the share whose ACL you want to display.
Select Properties from the drop-down menu.
Click the Share Permissions tab.
Result: The ACL of the share is displayed.

If you want to change the ACL for a user, select the group or user from the "Group or user names" box and change the permissions in the "Permissions for group or user name" box, as shown in the following example.

Adding a user or group to an ACL with the MMC

To add a user or group to an ACL with the MMC, complete the following steps.

Step	Action
1	Connect to the storage system using the MMC as described in Connecting to the storage system using MMC.
2	Perform the following actions to add a user or group to an ACL of a share: Click Computer Management, if it is not selected already. Double-click System Tools > Shared Folders > Shares. In the right panel, right-click the share to whose ACL you want to add the user or the group. Select Properties from the drop-down menu. Click the Share Permissions tab. Click Add. In the Select Users, Computers, or Groups window, enter the name of the user in the "Enter the object names to select" box, as shown in the following example. Click OK. Result: A user or a group is added to the ACL.

Step

Action

Connect to the storage system using the MMC as described in Connecting to the storage system using MMC.

Perform the following actions to add a user or group to an ACL of a share:

Click Computer Management, if it is not selected already.
Double-click System Tools > Shared Folders > Shares.
In the right panel, right-click the share to whose ACL you want to add the user or the group.
Select Properties from the drop-down menu.
Click the Share Permissions tab.
Click Add.
In the Select Users, Computers, or Groups window, enter the name of the user in the "Enter the object names to select" box, as shown in the following example.

Click OK.
Result: A user or a group is added to the ACL.

Removing an entry from an ACL with the MMC

To remove an entry from an ACL with the MMC, complete the following steps.

Step	Action
1	Connect to the storage system using the MMC as described in Connecting to the storage system using MMC.
2	Perform the following actions to delete a user or group from an ACL of a share: Click Computer Management, if it is not selected already. Double-click System Tools > Shared Folders > Shares. In the right panel, right-click the share from whose ACL you want to delete the user or the group. Select Properties from the drop-down menu. Click the Share Permissions tab. Result: A user or a group is deleted from the ACL.

Step

Action

Connect to the storage system using the MMC as described in Connecting to the storage system using MMC.

Perform the following actions to delete a user or group from an ACL of a share:

Click Computer Management, if it is not selected already.
Double-click System Tools > Shared Folders > Shares.
In the right panel, right-click the share from whose ACL you want to delete the user or the group.
Select Properties from the drop-down menu.
Click the Share Permissions tab.
Result: A user or a group is deleted from the ACL.

Changing an ACL from the Data ONTAP command line

To change an ACL from the Data ONTAP command line, complete the following step.

Step	Action
1	Enter the following command: cifs access share [-g] {user \| group} rights The `-g` argument specifies that the permissions are defined for a UNIX group. Do not include the `-g` argument if the permissions are for a Windows group. The command syntax does not provide a mechanism to differentiate between a Windows user name and a Windows group name. user is a UNIX user name or a Windows user name. group is a UNIX group name or a Windows group name. If the group is a local group, specify the storage system name as the domain name (for example, toaster\writers). rights is a set of UNIX-style permissions or Windows permissions. Examples The following examples assign access rights to the share named library: `cifs access library -g engineering rwx` `cifs access library marketing\joed Change`

Step

Action

Enter the following command:

cifs access share [-g] {user | group} rights

The -g argument specifies that the permissions are defined for a UNIX group. Do not include the -g argument if the permissions are for a Windows group. The command syntax does not provide a mechanism to differentiate between a Windows user name and a Windows group name.

user is a UNIX user name or a Windows user name.

group is a UNIX group name or a Windows group name. If the group is a local group, specify the storage system name as the domain name (for example, toaster\writers).

rights is a set of UNIX-style permissions or Windows permissions.

Examples

The following examples assign access rights to the share named library:

cifs access library -g engineering rwx
cifs access library marketing\joed Change

Removing an entry from an ACL with the Data ONTAP command line

To remove an entry from an ACL with the Data ONTAP command line, complete the following step.

Step	Action
1	Enter the following command: *cifs access -delete share* {user \| group}** Examples The following command removes the engineering group from the ACL for the library share: cifs access -delete library engineering The following command removes the user marketing\joed from the ACL for the library share. cifs access -delete library marketing\joed

Step

Action

Enter the following command:

cifs access -delete share {user | group}

Examples

The following command removes the engineering group from the ACL for the library share:

cifs access -delete library engineering

The following command removes the user marketing\joed from the ACL for the library share.

cifs access -delete library marketing\joed

Displaying share-level ACLs from the Data ONTAP command line

To display share-level ACLs, complete the following step.

Step	Action
1	Enter the following command: *cifs shares [share_name]* Result If the storage system uses password authentication, the permission style displayed in share-level ACLs is UNIX style. If the storage system uses domain controller authentication, the permission style is identical to the style you used when specifying the ACLs, with the following exceptions: If you specified `rwx` as the UNIX-style permissions, the permissions are displayed as Full Control in the ACL. If you specified `---` as the UNIX-style permissions, the permissions are displayed as No Access in the ACL. If you specified `r-x` as the UNIX-style permissions, the permissions are displayed as Read in the ACL.

Step

Action

Enter the following command:

cifs shares [share_name]

Result

If the storage system uses password authentication, the permission style displayed in share-level ACLs is UNIX style. If the storage system uses domain controller authentication, the permission style is identical to the style you used when specifying the ACLs, with the following exceptions:

If you specified rwx as the UNIX-style permissions, the permissions are displayed as Full Control in the ACL.
If you specified --- as the UNIX-style permissions, the permissions are displayed as No Access in the ACL.
If you specified r-x as the UNIX-style permissions, the permissions are displayed as Read in the ACL.