Depeche Chmod: Mac OS X Server / Xsan Permissions Hero

We ran into an annoyance today with Xsan Admin which probably also happens in Server Admin from time to time as well. We wanted to remove all inherited ACL entries from all subdirectories and files within a particular folder on the SAN volume. Deselecting the inheritance attributes and propagating ACL's in Xsan Admin from the top level directory didn't do anything though. Our subdirectories and files within them were still inheriting the ACE's (access control entries):

With a gazillion subdirectories in the folder hierarchy on this volume, you can imagine how fun it would be to remove each inherited entry one by one (which Xsan Admin will allow you to do, even though it shows them being greyed out).

Enter our favorite little utility: Terminal. More specifically, our trusty friend, chmod.

If you're familiar with chmod, you've probably used it a slew of times to modify POSIX permissions and various other bits and attributes. What's great about it though, is that you can also change ACL's...recursively. What's even better, is that it actually works.

Make sure you're logged in as an administrator, then open Terminal.app (/Applications/Utilities/Terminal).

Here's the command:

sudo chmod -R -N ./*

The sudo allows you to run the command as root (superuser), which you'll need to provide a root password to do. You want to run it from the directory that you need to propagate from. To make sure you're in the right directory, just type pwd while in Terminal, and it will display the path that you're currently in. Alternatively, you can specify the exact path from anywhere in the file system so you don't have to cd into the directory before running the command:

sudo chmod -R -N /Volumes/MySanVolume/*

The -R flag is for recursion (propagates permissions through all subdirectories within the path you specify), and the -N flag removes all ACL entries for the specified file(s) or directory(ies).

chmod can do a whole plethora of other fantastic things as well. Of course as with any UNIX/Darwin command, for more info, open Terminal and enter:

man chmod

A brief word of caution: remember that there is no "undo" when you're working at the command line. Be careful with typos and such. To quote someone famous, "with great power comes great responsibility..."

'Til next time...