Changing and displaying file-level ACLs

About file-level ACLs

Permission settings for files and directories are stored in file-level ACLs. These ACLs follow the Windows 2000 NTFS security model. For files that have NTFS-style security, CIFS users can set and display file-level ACLs from their PC. All files in an NTFS-style qtree and some files in a mixed qtree might have NTFS-style security.

Files in a FAT (file allocation table) file system do not have ACLs; they use UNIX permissions. When viewed from a CIFS client, files without ACLs will not display the Security tab in the file Properties window.

The file system (FAT or NTFS) for a given resource depends upon the storage system authentication method and qtree style for that resource.

qtree style and authentication method	File system
UNIX-style qtree and all authentication methods	FAT
Mixed or NTFS-style qtree and /etc/passwd authentication	FAT
Mixed or NTFS-style qtree and domain or workgroup authentication	NTFS

Permission types in a file-level ACL

Data ONTAP supports all permission types supported by Windows file-level ACLs.

Displaying and setting a file-level ACL

To display and set a file-level ACL, complete the following steps.

Step	Action
1	From the Windows desktop, right-click a file and select Properties from the pop-up menu.
2	Click the Security tab. Note Depending on authentication method and qtree style, the Security tab might not be present.
3	Select the user or the group whose permissions you want to display from the "Group or user names" box. Result: The permissions for the group or the user you selected are displayed in the Permissions for user or group box, as shown in the following example.
4	If you want to add a user or a group to the file, do the following: Click Add. In the "Select Users, Computers, or Groups" window, enter the name of the user or the group in the "Enter the object names to select" box as shown in the following example. Click OK. Result: A user or a group is added to the ACL.

Limitations of Windows NT4 clients on shares that support wide symbolic links

On an NT4 client, if you right-click a file that is located in a share that supports wide symbolic links and select Properties, no Security tab is displayed. You can set security using a security tool such as cacls. Alternatively, you can either access files from a Windows 2000 client or access files using shares that don't support wide symbolic links. You can have two different shares on the same directory, one that supports wide symbolic links and one that does not, and use the share that does not support wide symbolic links when setting security.