Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

Extended permissions (ACL)

4 min Linux · acl

Flexible rights beyond rwx — getfacl/setfacl, per-user and per-group grants.

Cheat sheet

8 commands Printable version
  • getfacl file show ACL (+ in ls -l)
  • setfacl -m u:user:rw file grant a user
  • setfacl -m g:grp:rx dir grant a group
  • setfacl -d -m u:user:rw dir inheritance (default ACL)
  • setfacl -m m::rwx file raise the mask
  • setfacl -b file remove all ACL entries
  • getfacl -R dir > acl.bak save the tree's ACL to a file
  • setfacl --restore=acl.bak restore ACL from a file

Overview

Classic permissions (see permissions) grant access only to the owner, one group, and everyone else. ACL let you grant rights to specific users and groups on top of that.

The sign of ACL in ls -l is a +: -rw-rw----+.

bash 
getfacl file                      # show ACL
getfacl -R dir > acl.bak          # save the tree's ACL (backup before changes)

Recipes

2

Commands

bash 
setfacl -m u:alice:rw file        # grant alice rw (-m = modify)
setfacl -m g:devs:rx dir          # grant group devs rx
setfacl -m u:alice:rw,g:devs:r f  # several entries at once
setfacl -x u:alice file           # remove alice's ACL entry
setfacl -b file                   # remove ALL ACL entries
setfacl -R -m u:alice:rX dir      # recursive (X = x only for dirs/executables)
setfacl --restore=acl.bak         # restore from getfacl -R

# default ACL — inheritance for NEW files in a directory:
setfacl -d -m u:alice:rw dir      # new files inside will get rw for alice
setfacl -k dir                    # remove the default ACL

mask

In getfacl output, the mask:: line sets the ceiling of effective rights for named users/groups (everyone except the owner and other). If rights look granted but do not work — check the mask:

bash 
getfacl file                      # lines marked #effective:r-- are capped by the mask
setfacl -m m::rwx file            # raise the mask to rwx

setfacl normally recalculates the mask automatically; --no-mask turns that off.

Troubleshooting

5

Permissions look right, but access is missing / extra

ACL is in play. Check getfacl, not just ls -l. The + in ls -l hints that ACL entries exist.

I granted rw to a named user, but they still cannot write

The mask is capping it: getfacl shows #effective:r--. Raise it with setfacl -m m::rwx.

ACL entries are not inherited by new files

You need default ACL on the directory (setfacl -d -m ...). Regular ACL entries are not inherited; default ACL applies only to files created afterward.

ACL "disappeared" after a copy or backup

cp does not carry ACL over by default — use cp -a/--preserve=all, rsync -A, or tar --acls. Back up ACL with getfacl -R, restore with setfacl --restore=.

The filesystem does not support ACL

It needs the acl mount option (usually on by default on ext4). Check tune2fs -l / the options in mount.

See also

  • permissions — The Unix permission model — read/write/execute, owner/group/other, special bits.
  • chmod-chown — Changing permissions (chmod) and owner/group (chown) — numeric and symbolic syntax.

Found an inaccuracy? Report an error in the article

Lessons on this topic

Topics
Loading…