MacOS – What are all the available ACL attributes in Mac OS 10.13 High Sierra

aclhigh sierramacospermission

In Mac OS, file and folder access permissions are managed in a layered way with basic unix (POSIX) style owner/group/everyone read/write/execute modes along with, recently added access control lists (ACL) for additional access control.

Both the POSIX and ACL controls can be managed from the command line with the traditional unix command 'chmod'. For example:

Mac:~> sudo chmod -R +a "staff allow list,addfile,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown,file_inherit,directoryinherit" path/to/folder*

What is the comprehensive list of all ACL attributes which are settable in Mac OS 10.13 (High Sierra)? What does each mean?

Best Answer

A comprehensive list of ACL attributes is available by consulting the man pages:

man chmod

If you prefer a GUI app to show man pages download and install e.g. ManOpen (free) or Dash for macOS (a few $$).

I won't list the whole documentation of chmod:

...

ACL MANIPULATION OPTIONS


 ACLs are manipulated using extensions to the symbolic mode grammar.  Each
 file has one ACL, containing an ordered list of entries.  Each entry
 refers to a user or group, and grants or denies a set of permissions.  In
 cases where a user and a group exist with the same name, the user/group
 name can be prefixed with "user:" or "group:" in order to specify the
 type of name.

 If the user or group name contains spaces you can use ':' as the delim-
 iter between name and permission.

 The following permissions are applicable to all filesystem objects:
       delete  Delete the item.  Deletion may be granted by either this
               permission on an object or the delete_child right on the
               containing directory.
       readattr
               Read an objects basic attributes.  This is implicitly
               granted if the object can be looked up and not explicitly
               denied.
       writeattr
               Write an object's basic attributes.
       ...
Related Question