remove an ACL entry for just ONE user in MacOS? oddly difficult

Question

I'm trying to remove an ACL set for johndoe from all the folders recursively on one of my drives without hosing any other entries! Anyone know how to do this without affecting the ACLs that already exist for other groups/users?

I'm looking for the Mac equivalent of "setfacl -d u:johndoe"

I know you can use chmod to remove a rule from multiple files, but the only way I have seen won't work because it removes the rule via its index (eg: the 5th entry of every folder) and the entry for my user won't always be the same index.

Why would you want to do this? Say you inherit an insane file system that has a bunch of individual users instead of groups and you want to get rid of just the individuals since they already have access.

Answer 1

I'd grep the output of ls -le for the username, then remove the rule with the index number you found using awk. As long as you don't call your users read, write, deny, allow, delete or such ;)

Answer 2

find / -print0 -type fd | xargs -0 ls -le | more

might help you to start exploring the filesystem.

You could replace more with another command, such as a grep for ACL output, and a subsequent pipe to handle the results of grep with fsaclctl.

Answer 3

How about the chmod "-a" option?

find . -exec chmod -a "johndoe allow delete,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown,read,write,append,execute,list,search,add_file,add_subdirectory,delete_child" {} \;

It will remove all ACL permissions for johndoe on all files recursively from the current directory. (It will print errors for all files without an ACL, but it will still work on the rest of 'em). As you mentioned, you'll have to run this with "inherited" and "deny" as well.

EDIT: Here are tools that use ACLs on Mac OS X:

# cat has_acl.sh 
otool -IV $1 2>&1 | grep _acl_ > /dev/null
# find /bin /sbin /usr/bin /usr/sbin -exec ./has_acl.sh {} \; -print
/bin/chmod
/bin/ls
/usr/bin/ex
/usr/bin/rview
/usr/bin/rvim
/usr/bin/vi
/usr/bin/view
/usr/bin/vim
/usr/bin/vimdiff
/usr/sbin/cupsd
/usr/sbin/kadmind
/usr/sbin/pkgutil

vi only reads & preserves the ACLs, the others don't seem useful, either. But there could be 3rd party tool. Maybe in Fink/MacPorts?