University Computing Systems

AFS Permissions & Unix Mode Bits

AFS calculates file access based on two factors: the ACL (access control list) entries of the given directory, and the Unix owner mode bits.

• ACL entries: A user may access a file only according to the ACL that user possesses in that directory, either as the user directly, or as a member of an AFS group. If the owner bits on a file or directory forbid a specific type of access (e.g., writing to the file, executing the file), no one may access the file in that way no matter what their ACL access rights are.

• Unix owner mode bits: AFS ignores the group and other mode bits, and looks only at the owner mode bits.

• A user with appropriate AFS rights can read a file only if the the Unix owner "r" bit is turned on

• A user with appropriate AFS rights can write to a file only if the Unix owner "w" bit is turned on

• A user with appropriate AFS rights can execute a file only if the Unix owner "x" bit is turned on

  Users can use the Unix chmod command to set mode bits on their directories and files -- remember, AFS cares only about the owner bits. The user must have write (w) and lookup (l) rights on a directory to change the mode bits of a file in that directory.