Skip to content

Beginner · Permissions, users and sudo · topic 11 of 57 · 25 min

Access control lists (ACLs)

Explanation

Normal permissions allow only one owner and one group. An ACL (access control list) adds extra entries for named users and groups, set with setfacl and read with getfacl. A + at the end of ls -l permissions means an ACL exists, and default ACLs on a directory are passed to new files.

The problem ACLs solve

The finance directory belongs to the finance group. Now the auditor, who is not in finance, needs to READ it for a month, and the HR group needs read access to one file. With only owner, group and others you cannot express this without opening the file to everyone. An ACL lets you add exact extra rules.

Think of it like this: Normal permissions are like a building pass with three colours: owner, team, visitor. An ACL is a guest list at the reception: "Mr Iyer from the audit firm may enter floor 3, read only, until 30 November." The colours still work; the list adds named exceptions.

Reading and setting ACLs

bash
# setfacl -m u:iyer:rx /srv/finance            # user iyer: read + enter
# setfacl -m g:hr:r /srv/finance/salaries.csv  # group hr: read this file
# getfacl /srv/finance
# file: srv/finance
# owner: root
# group: finance
user::rwx
user:iyer:r-x
group::rwx
mask::rwx
other::---
$ ls -ld /srv/finance
drwxrwx---+ 2 root finance 26 Oct 19 13:00 /srv/finance
-m modifies (adds) entries. The + after the permissions tells you an ACL exists.

The mask

The mask entry is the maximum that named users, named groups and the owning group can get. If the mask is r--, then user:iyer:rwx actually works as r-- (getfacl shows #effective:r--). chmod on a file with an ACL changes the mask when you change the group digits, which can quietly reduce what ACL users get. Check getfacl after a chmod.

Default ACLs for new files

An ACL on a directory does not apply to files created later. For that, set a default ACL (d:) on the directory. New files and subdirectories inherit it. Usually you set both: one for what exists now (with -R) and a default for the future.

bash
# setfacl -R -m u:iyer:rX /srv/finance       # existing files and dirs (X = x only on dirs)
# setfacl -m d:u:iyer:rx /srv/finance         # default for new files
# setfacl -x u:iyer /srv/finance              # remove one entry
# setfacl -b /srv/finance                     # remove all ACL entries
# getfacl /srv/finance > finance.acl          # back up ACLs
# setfacl --restore=finance.acl               # restore them
OptionMeaning
-mModify / add entries, e.g. u:name:rw, g:name:r
-xRemove an entry
-bRemove all extended entries
-RRecursive
d:Prefix that makes a default (inherited) entry

Common mistakes

  • Setting only a default ACL and wondering why the user cannot open existing files. Defaults apply to NEW files only; also run setfacl -R -m.
  • Forgetting x on the directories in the path. iyer needs at least x on /srv as well.
  • Copying files with plain cp, which drops ACLs. Use cp -a or tar with --acls when ACLs matter.
  • Ignoring the mask: if an entry does not work, look for #effective in getfacl.
Tip: XFS and ext4 on RHEL support ACLs by default, so no special mount option is needed.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

Access control lists (ACLs) · 1/6

owner · group · others + named entries

Normal permissions allow one owner and one group. ACLs add extra named users and groups.

Prefer a video by a teacher? Find free videos on “linux acl setfacl getfacl tutorial rhcsa” on YouTube ↗

In real life: Giving a CA firm read access for the annual audit

A Chennai manufacturing company hires an external chartered accountant firm for its audit. The CA's account must read the ledgers for six weeks without joining the finance group. The admin adds an ACL entry with read access and a default entry for new files, sets the account to expire after six weeks, and removes the ACL with setfacl -x when the audit ends.

bash
# useradd -e 2026-12-15 ca_auditor
# setfacl -R -m u:ca_auditor:rX /srv/ledgers
# setfacl -m d:u:ca_auditor:rX /srv/ledgers
# getfacl -c /srv/ledgers | grep ca_
user:ca_auditor:r-x
default:user:ca_auditor:r-x

Practice (0/3 done)

Task 1 · Question

What does the + in drwxr-x---+ mean?

Task 2 · Question

Which command gives user ravi read and write on report.txt without changing the owner or group?

Task 3 · Practice

Copy /etc/fstab to /var/tmp/fstab. Make it owned by root with mode 644. Then use ACLs so that user "natasha" can read and write it, user "harry" can neither read nor write it, and everyone else can still read it.

Quick quiz

Question 1

1.Which command shows the ACL of a file?

Question 2

2.What does setfacl -m d:g:dev:rwx /srv/code do?

Question 3

3.An ACL says user:ravi:rw- but getfacl shows #effective:r--. Why?

Question 4

4.Which removes every ACL entry from a file?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

Which command shows the ACL of a file?

Answer: getfacl

getfacl prints all ACL entries.

What does setfacl -m d:g:dev:rwx /srv/code do?

Answer: Sets a default ACL so new files give group dev rwx

d: makes a default entry that new files inherit.

An ACL says user:ravi:rw- but getfacl shows #effective:r--. Why?

Answer: The mask is r--

The mask limits named entries.

Which removes every ACL entry from a file?

Answer: setfacl -b file

-b removes all extended entries.

Which command shows how many packets matched each ACL rule?Related

Answer: show access-lists

show access-lists prints each rule with its matches counter.

From Access control lists (ACLs)

A file is owned by asha with mode 604 (rw----r--). asha is also in the file's group. Can asha read it?Related

Answer: Yes, as owner

The owner set rw- applies to asha, so she can read and write.

From File permissions: rwx, chmod and chown

On a directory, what does the x permission allow?Related

Answer: Entering the directory with cd

For directories, x means you may enter (traverse) it.

From Users, groups and permissions

What is the dotted decimal mask for /27?Related

Answer: 255.255.255.224

/27 = 24 + 3: three ones in the last octet = 128 + 64 + 32 = 224.

From Subnet masks, prefix length and wildcard masks

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: sudo and the sudoers file →

Next steps

  1. 1 more topic in “Permissions, users and sudo” before its exam: sudo and the sudoers file.
  2. Module 2 exam: Permissions, users and sudo · 14 questions · 25 min, without help. 6 topics of this module still to finish first.
  3. Then the next module, Processes, services and logs. 57 topics left in the course before the final exam.

← Previous: umask and the special bits: SUID, SGID and sticky