APIs in Category: file-directory-security | Cluster-Mode API version 1.20

file-directory-security-ntfs-dacl-get-iter file-directory-security-ntfs-get-iter file-directory-security-ntfs-sacl-get-iter file-directory-security-policy-get-iter file-directory-security-policy-task-get-iter | This set of ZAPIs allows to view or set file security settings. To view security of a file/folder, pass the file/folder path name as argument to show command. To set security on a file/folder, policy needs to be created. Policy has set of tasks and each task has a file/folder path name and the security descriptor identifier which will be applied on the file/folder.

NetApp Manage ONTAP

file-directory-security-ntfs-dacl-get-iter | [top]

> Returns information about one or more discretionary access control entries

> Input Name | Range | Type | Description
> desired-attributes |  | file-directory-security-ntfs-dacl optional | Specify the attributes that should be returned. If not present, all attributes for which information is available will be returned. If present, only the desired attributes for which information is available will be returned.
> max-records | [1..2^32-1] | integer optional | The maximum number of records to return in this call. Default: 20
> query |  | file-directory-security-ntfs-dacl optional | A query that specifies which objects to return. A query could be specified on any number of attributes in the file-directory-security-ntfs-dacl object. All file-directory-security-ntfs-dacl objects matching this query up to 'max-records' will be returned.
> tag |  | string optional | Specify the tag from the last call. It is usually not specified for the first call. For subsequent calls, copy values from the 'next-tag' obtained from the previous call.
> Output Name | Range | Type | Description
> attributes-list |  | file-directory-security-ntfs-dacl[] optional | The list of attributes of file-directory-security-ntfs-dacl objects.
> next-tag |  | string optional | Tag for the next call. Not present when there are no more file-directory-security-ntfs-dacl objects to return.
> num-records | [0..2^32-1] | integer | The number of records returned in this call.

> Errno | Description
> EINTERNALERROR |  |

file-directory-security-ntfs-get-iter | [top]

> Returns information about one or more NTFS security descriptor

> Input Name | Range | Type | Description
> desired-attributes |  | file-directory-security-ntfs optional | Specify the attributes that should be returned. If not present, all attributes for which information is available will be returned. If present, only the desired attributes for which information is available will be returned.
> max-records | [1..2^32-1] | integer optional | The maximum number of records to return in this call. Default: 20
> query |  | file-directory-security-ntfs optional | A query that specifies which objects to return. A query could be specified on any number of attributes in the file-directory-security-ntfs object. All file-directory-security-ntfs objects matching this query up to 'max-records' will be returned.
> tag |  | string optional | Specify the tag from the last call. It is usually not specified for the first call. For subsequent calls, copy values from the 'next-tag' obtained from the previous call.
> Output Name | Range | Type | Description
> attributes-list |  | file-directory-security-ntfs[] optional | The list of attributes of file-directory-security-ntfs objects.
> next-tag |  | string optional | Tag for the next call. Not present when there are no more file-directory-security-ntfs objects to return.
> num-records | [0..2^32-1] | integer | The number of records returned in this call.

> Errno | Description
> EINTERNALERROR |  |

file-directory-security-ntfs-sacl-get-iter | [top]

> Returns information about one or more system/audit access control entries

> Input Name | Range | Type | Description
> desired-attributes |  | file-directory-security-ntfs-sacl optional | Specify the attributes that should be returned. If not present, all attributes for which information is available will be returned. If present, only the desired attributes for which information is available will be returned.
> max-records | [1..2^32-1] | integer optional | The maximum number of records to return in this call. Default: 20
> query |  | file-directory-security-ntfs-sacl optional | A query that specifies which objects to return. A query could be specified on any number of attributes in the file-directory-security-ntfs-sacl object. All file-directory-security-ntfs-sacl objects matching this query up to 'max-records' will be returned.
> tag |  | string optional | Specify the tag from the last call. It is usually not specified for the first call. For subsequent calls, copy values from the 'next-tag' obtained from the previous call.
> Output Name | Range | Type | Description
> attributes-list |  | file-directory-security-ntfs-sacl[] optional | The list of attributes of file-directory-security-ntfs-sacl objects.
> next-tag |  | string optional | Tag for the next call. Not present when there are no more file-directory-security-ntfs-sacl objects to return.
> num-records | [0..2^32-1] | integer | The number of records returned in this call.

> Errno | Description
> EINTERNALERROR |  |

file-directory-security-policy-get-iter | [top]

> Returns information about one or more security policies. To preserve the security configuration of a file(or, folder) or set of files(or, folders) security policy has been defined. Policy is a container for tasks and a task associates a file/folder path name and the security descriptor that needs to be set on the file/folder. Every task in a policy is uniquely identified by the file/folder path. Policy can't have duplicate task entries and there is only one task per path.

> Input Name | Range | Type | Description
> desired-attributes |  | file-directory-security-policy optional | Specify the attributes that should be returned. If not present, all attributes for which information is available will be returned. If present, only the desired attributes for which information is available will be returned.
> max-records | [1..2^32-1] | integer optional | The maximum number of records to return in this call. Default: 20
> query |  | file-directory-security-policy optional | A query that specifies which objects to return. A query could be specified on any number of attributes in the file-directory-security-policy object. All file-directory-security-policy objects matching this query up to 'max-records' will be returned.
> tag |  | string optional | Specify the tag from the last call. It is usually not specified for the first call. For subsequent calls, copy values from the 'next-tag' obtained from the previous call.
> Output Name | Range | Type | Description
> attributes-list |  | file-directory-security-policy[] optional | The list of attributes of file-directory-security-policy objects.
> next-tag |  | string optional | Tag for the next call. Not present when there are no more file-directory-security-policy objects to return.
> num-records | [0..2^32-1] | integer | The number of records returned in this call.

> Errno | Description
> EINTERNALERROR |  |

file-directory-security-policy-task-get-iter | [top]

> Returns information about one or more policy tasks. Policy is a container for tasks and a task associates a file/folder path name and the security descriptor that needs to be set on the file/folder. Every task in a policy is uniquely identified by the file/folder path. Policy can't have duplicate task entries and there is only one task per path.

> Input Name | Range | Type | Description
> desired-attributes |  | file-directory-security-policy-task optional | Specify the attributes that should be returned. If not present, all attributes for which information is available will be returned. If present, only the desired attributes for which information is available will be returned.
> max-records | [1..2^32-1] | integer optional | The maximum number of records to return in this call. Default: 20
> query |  | file-directory-security-policy-task optional | A query that specifies which objects to return. A query could be specified on any number of attributes in the file-directory-security-policy-task object. All file-directory-security-policy-task objects matching this query up to 'max-records' will be returned.
> tag |  | string optional | Specify the tag from the last call. It is usually not specified for the first call. For subsequent calls, copy values from the 'next-tag' obtained from the previous call.
> Output Name | Range | Type | Description
> attributes-list |  | file-directory-security-policy-task[] optional | The list of attributes of file-directory-security-policy-task objects.
> next-tag |  | string optional | Tag for the next call. Not present when there are no more file-directory-security-policy-task objects to return.
> num-records | [0..2^32-1] | integer | The number of records returned in this call.

> Errno | Description
> EINTERNALERROR |  |

Element definition: file-directory-security-ntfs | [top]

> NTFS security descriptor management When returned as part of the output, all elements of this typedef are reported, unless limited by a set of desired attributes specified by the caller. When used as input to specify desired attributes to return, omitting a given element indicates that it shall not be returned in the output. In contrast, by providing an element (even with no value) the caller ensures that a value for that element will be returned, given that the value can be retrieved. When used as input to specify queries, any element can be omitted in which case the resulting set of objects is not constrained by any specific value of that attribute.

> Name | Range | Type | Description
> control-flags-raw | [0..2^32-1] | integer optional | Specifies the security descriptor control flags in hexa decimal. The following are the bit fields of control flags. 1... .... .... .... = Self Relative .0.. .... .... .... = RM Control Valid ..0. .... .... .... = SACL Protected ...0 .... .... .... = DACL Protected .... 0... .... .... = SACL Inherited .... .0.. .... .... = DACL Inherited .... ..0. .... .... = SACL Inherit Required .... ...0 .... .... = DACL Inherit Required .... .... ..0. .... = SACL Defaulted .... .... ...0 .... = SACL Present .... .... .... 0... = DACL Defaulted .... .... .... .1.. = DACL Present .... .... .... ..0. = Group Defaulted .... .... .... ...0 = Owner Defaulted At present only the following flags are honored. Others are ignored. ..0. .... .... .... = SACL Protected ...0 .... .... .... = DACL Protected .... .... ..0. .... = SACL Defaulted .... .... .... 0... = DACL Defaulted .... .... .... ..0. = Group Defaulted .... .... .... ...0 = Owner Defaulted Attributes: optional-for-create, modifiable
> group |  | name-or-sid optional | Specifies group's SID or domain account name of NTFS security descriptor. Attributes: optional-for-create, modifiable
> ntfs-sd |  | fsecurity-ntfs-sd optional | Specifies NTFS security descriptor identifier. Attributes: key, required-for-create, non-modifiable
> owner |  | name-or-sid optional | Specifies owner's SID or domain account name of NTFS security descriptor. Attributes: optional-for-create, modifiable
> vserver |  | string optional | Vserver Attributes: key, non-creatable, non-modifiable

Element definition: file-directory-security-ntfs-dacl | [top]

> fsecurity SACL configuration When returned as part of the output, all elements of this typedef are reported, unless limited by a set of desired attributes specified by the caller. When used as input to specify desired attributes to return, omitting a given element indicates that it shall not be returned in the output. In contrast, by providing an element (even with no value) the caller ensures that a value for that element will be returned, given that the value can be retrieved. When used as input to specify queries, any element can be omitted in which case the resulting set of objects is not constrained by any specific value of that attribute.

> Name | Range | Type | Description
> access-type |  | access-type optional | Specifies DACL ACE's access type. Attributes: key, required-for-create, non-modifiable Possible values: "deny" , "allow"
> account |  | name-or-sid optional | Specifies DACL ACE's SID or domain account name of NTFS security descriptor. Attributes: key, required-for-create, non-modifiable
> advanced-rights |  | advanced-access-rights[] optional | Specifies DACL ACE's Advanced access rights. Mutually exclusive with rights and rights-raw fields. Attributes: optional-for-create, modifiable Possible values: "read_data" , "write_data" , "append_data" , "read_ea" , "write_ea" , "execute_file" , "delete_child" , "read_attr" , "write_attr" , "delete" , "read_perm" , "write_perm" , "write_owner" , "full_control"
> apply-to |  | inheritance-level[] optional | Specifies this ACE has to be applied on. Attributes: optional-for-create, modifiable Possible values: "this_folder" , "sub_folders" , "files"
> ntfs-sd |  | fsecurity-ntfs-sd optional | Specifies NTFS security descriptor identifier. Attributes: key, required-for-create, non-modifiable
> readable-access-rights |  | string optional | Specifies the current access rights. The access rights must be set to one among rights,advanced-rights,rights-raw. Attributes: non-creatable, non-modifiable
> rights |  | access-rights optional | Specifies DACL ACE's access rights. Mutually exclusive with advanced-rights and rights-raw fields. Attributes: optional-for-create, modifiable Possible values: "no_access" , "full_control" , "modify" , "read_and_execute" , "read" , "write"
> rights-raw | [0..2^32-1] | integer optional | Specifies DACL ACE's access rights in raw. This field is similar to advanced-rights fields. 'advanced-rights' specifies the value in enum but rights-raw specifies the access rights in integer format. Mutually exclusive with rights and advanced-rights fields. Attributes: optional-for-create, modifiable
> vserver |  | string optional | Vserver Attributes: key, non-creatable, non-modifiable

Element definition: file-directory-security-ntfs-sacl | [top]

> fsecurity SACL configuration When returned as part of the output, all elements of this typedef are reported, unless limited by a set of desired attributes specified by the caller. When used as input to specify desired attributes to return, omitting a given element indicates that it shall not be returned in the output. In contrast, by providing an element (even with no value) the caller ensures that a value for that element will be returned, given that the value can be retrieved. When used as input to specify queries, any element can be omitted in which case the resulting set of objects is not constrained by any specific value of that attribute.

> Name | Range | Type | Description
> account |  | name-or-sid optional | Specifies SACL ACE's SID or domain account name of NTFS security descriptor. Attributes: key, required-for-create, non-modifiable
> advanced-rights |  | advanced-access-rights[] optional | Specifies SACL ACE's access rights. Mutually exclusive with rights-raw field. Attributes: optional-for-create, modifiable Possible values: "read_data" , "write_data" , "append_data" , "read_ea" , "write_ea" , "execute_file" , "delete_child" , "read_attr" , "write_attr" , "delete" , "read_perm" , "write_perm" , "write_owner" , "full_control"
> apply-to |  | inheritance-level[] optional | Specifies how this ACE has to be applied on this folder and it's subfolders and files. This field is ignored if the security is mapped with a path which is not a folder. Attributes: optional-for-create, modifiable Possible values: "this_folder" , "sub_folders" , "files"
> audit-access-type |  | audit-access-type optional | Specifies SACL ACE's access type. Attributes: key, required-for-create, non-modifiable Possible values: "failure" , "success"
> ntfs-sd |  | fsecurity-ntfs-sd optional | Specifies NTFS security descriptor identifier. Attributes: key, required-for-create, non-modifiable
> readable-access-rights |  | string optional | Specifies the current access rights. Access rights can be specified by one of the following fields, rights, advanced-rights and rights-raw. These fields are mutually exclusive fields. If rights field is set and other two fields (advanced-rights, rights-raw) cant be set and so readable-access-rights field has the value of rights field. If rights-raw field is set and other two fields (advanced-rights, rights) are not set then readable-access-rights field has the value of rights-raw field. If advanced-rights field is set and other two fields (rights, rights-raw) are not set then readable-access-rights field has the value of advanced-rights field. Attributes: non-creatable, non-modifiable
> rights |  | access-rights optional | Specifies SACL ACE's access rights. Attributes: optional-for-create, modifiable Possible values: "no_access" , "full_control" , "modify" , "read_and_execute" , "read" , "write"
> rights-raw | [0..2^32-1] | integer optional | Specifies SACL ACE's access rights in raw. This field is similar to advanced-rights fields. 'advanced-rights' specifies the value in enum but rights-raw specifies the access rights in integer format. Mutually exclusive with rights and advanced-rights fields. Attributes: optional-for-create, modifiable
> vserver |  | vserverid optional | Vserver Attributes: key, non-creatable, non-modifiable

Element definition: file-directory-security-policy | [top]

> File/folder security policy management When returned as part of the output, all elements of this typedef are reported, unless limited by a set of desired attributes specified by the caller. When used as input to specify desired attributes to return, omitting a given element indicates that it shall not be returned in the output. In contrast, by providing an element (even with no value) the caller ensures that a value for that element will be returned, given that the value can be retrieved. When used as input to specify queries, any element can be omitted in which case the resulting set of objects is not constrained by any specific value of that attribute.

> Name | Range | Type | Description
> policy-name |  | fsecurity-policy-name optional | Specifies the name of the policy. To preserve the security configuration of a file(or, folder) or set of files(or, folders) security policy has been defined. Policy is a container for tasks and a task associates a file/folder path name and the security descriptor that needs to be set on the file/folder. Every task in a policy is uniquely identified by the file/folder path. Policy can't have duplicate task entries and there is only one task per path. Attributes: key, required-for-create, non-modifiable
> vserver |  | string optional | Vserver Attributes: key, non-creatable, non-modifiable

Element definition: file-directory-security-policy-task | [top]

> File security policy task management When returned as part of the output, all elements of this typedef are reported, unless limited by a set of desired attributes specified by the caller. When used as input to specify desired attributes to return, omitting a given element indicates that it shall not be returned in the output. In contrast, by providing an element (even with no value) the caller ensures that a value for that element will be returned, given that the value can be retrieved. When used as input to specify queries, any element can be omitted in which case the resulting set of objects is not constrained by any specific value of that attribute.

> Name | Range | Type | Description
> ntfs-mode |  | ntfs-propagation-mode optional | Specifies the NTFS propagation mode. Attributes: optional-for-create, modifiable Possible values: "propagate" , "ignore" , "replace"
> ntfs-sd |  | fsecurity-ntfs-sd optional | Specifies the NTFS security descriptor identifier. Attributes: optional-for-create, modifiable
> path |  | string optional | Specifies the file or folder path of a task. Attributes: key, required-for-create, non-modifiable
> policy-name |  | fsecurity-policy-name optional | Specifies the name of the policy who has the task. Attributes: key, required-for-create, non-modifiable
> security-type |  | security-type optional | Specifies the type of security. Attributes: optional-for-create, modifiable Possible values: "ntfs" , "nfsv4"
> task-index-number | [1..10000] | integer optional | Specifies the target index/position of this task in the policy. If the task is currently placed in 5th position in a policy and you want to reorder this task as 2nd task, you can set the index-num to 2. If the index number exceeds the number of positions, it will go at the end. Attributes: optional-for-create, modifiable
> vserver |  | string optional | Vserver Attributes: key, non-creatable, non-modifiable

Element definition: access-rights | [top]

> no-access|full-control|modify|read-and-execute|read|write Possible values: "no_access" , "full_control" , "modify" , "read_and_execute" , "read" , "write"

> [none]

Element definition: access-type | [top]

> deny|allow Possible values: "deny" , "allow"

> [none]

Element definition: advanced-access-rights | [top]

> Advanced access right Possible values: "read_data" , "write_data" , "append_data" , "read_ea" , "write_ea" , "execute_file" , "delete_child" , "read_attr" , "write_attr" , "delete" , "read_perm" , "write_perm" , "write_owner" , "full_control"

> [none]

Element definition: audit-access-type | [top]

> failure|success Possible values: "failure" , "success"

> [none]

Element definition: fsecurity-ntfs-sd | [top]

> NTFS file security descriptor identifier. This can be any valid text input.

> [none]

Element definition: fsecurity-policy-name | [top]

> The file/folder security policy identifier. This can be any valid text.

> [none]

Element definition: inheritance-level | [top]

> this-folder|sub-folders|files Possible values: "this_folder" , "sub_folders" , "files"

> [none]

Element definition: name-or-sid | [top]

> An user or group name that is specified in the form of valid username/groupname with domain or valid SID string

> [none]

Element definition: ntfs-propagation-mode | [top]

> propagate|ignore|replace Possible values: "propagate" , "ignore" , "replace"

> [none]

Element definition: security-type | [top]

> ntfs|nfsv4 Possible values: "ntfs" , "nfsv4"

> [none]

Element definition: vserverid | [top]

> Vserver Id

> [none]