ACLs in Linux: Fine Permissions with getfacl

chmod gives every file three permission classes: owner, group, others. But real machines have a fourth situation — "one extra user needs exactly this folder" — and POSIX ACLs are the answer: per-user and per-group permissions layered on top of the classic bits.

Reading ACLs #

$ ls -l shared/
-rw-rw----+ 1 ana devs 512 Oct 21 plan.md
$ getfacl shared/plan.md
user::rw-
user:oma:r--        # extended entry
group::rw-
mask::rw-
other::---

The + after the permission string is the tell. getfacl prints the base triplet plus extended entries — here oma can read the file regardless of the "others" class, without adding oma to the devs group.

Granting access #

setfacl writes the extended entries:

$ setfacl -m u:oma:rX shared/
$ setfacl -m g:design:rw shared/mockups/   # a whole group
$ setfacl -x u:oma shared/                  # take it back
$ setfacl -b shared/                        # remove all extended entries

-m modifies, -x removes one entry, -b wipes the layer. Recursive grants take -R, and -d sets default ACLs — the template a directory's future children inherit, which is how shared folders stay shared without constant re-chmodding:

$ setfacl -d -m g:design:rwX shared/

The mask, honestly #

Every ACL carries a mask — the ceiling on what extended entries can grant. Watch it interact with chmod:

The "effective" comments getfacl prints when the mask trims an entry are not decoration — they are the actual permissions.

Classic modes remain the default tool — see chmod and umask. The terminal notes series continues on the journal.