Re: Security Descriptor noob question

I believe you can't do that, and to modify the perms using the
file-directory commands you'll need to create an ntfs-sd, add the right
ACEs you want (and you can't just tell the ntfs-sd to populate itself based
on an existing files ACL) then create a policy and policy tasks to apply
the SD to a path.

If you want to modify only one ACE, you still need to set up the ntfs-sd to
have all the ACEs in it as running the policy will blow away the existing
DACL and replace with what the ntfs-sd has, not just modify the individual
ACE you mentioned.

Cheers

Graham


On Sat., 23 Oct. 2021, 10:07 pm Carl Howell, <[email protected]> wrote:

> I have a test volume with a CIFS share and default permissions. If I want
> to modify the NTFS permissions using either vserver security file-directory
> ntfs modify...or something like Ansible, how do I find the security
> descriptor to modify(ntfs-sd):
>
> vserver security file-directory show -vserver svm1 -path /test4 -instance
>
>                 Vserver: svm1
>               File Path: /test4
>       File Inode Number: 64
>          Security Style: ntfs
>         Effective Style: ntfs
>          DOS Attributes: 10
>  DOS Attributes in Text: ----D---
> Expanded Dos Attributes: -
>            UNIX User Id: 0
>           UNIX Group Id: 0
>          UNIX Mode Bits: 777
>  UNIX Mode Bits in Text: rwxrwxrwx
>                    ACLs: NTFS Security Descriptor
>                          Control:0x8004
>                          Owner:BUILTIN\Administrators
>                          Group:BUILTIN\Administrators
>                          DACL - ACEs
>                            ALLOW-Everyone-0x1f01ff
>                            ALLOW-Everyone-0x10000000-OI|CI|IO
>
> Feel like I'm missing something obvious here. . .
>
> Thanks,
>
> --Carl
> _______________________________________________
> Toasters mailing list
> [email protected]
> https://www.teaparty.net/mailman/listinfo/toasters

_______________________________________________
Toasters mailing list
[email protected]
https://www.teaparty.net/mailman/listinfo/toasters