LFCS 39 🐧 Access Control Lists — getfacl, setfacl - KandZ

⏱️ Estimated read: 18 min | |

The standard permission model gives every file three sets of bits: one for the owner, one for the group, and one for everyone else. That is enough for most files, but it breaks down when a file must be shared with a specific set of users who do not share a group. Adding the users to the file’s group gives them all the group’s permissions, which may be more than they need. Creating a new group for each sharing pattern is impractical. Access Control Lists (ACLs) extend the model with a per-user and per-group entry list, so a file can grant read access to one user, write access to another, and nothing to everyone else, all without changing the standard bits.

Key point: An ACL is an extension of the standard permission bits, not a replacement. The ls -l output shows a + at the end of the permission string when an ACL is present. The getfacl command shows the full list, and the setfacl command modifies it.

Why ACLs exist

The single-group problem. A file belongs to exactly one group. If two users from different groups need access, the file cannot grant both without adding them to a group that also grants access to others. An ACL entry for each user solves the problem without touching the groups.

The over-granting problem. Adding a user to the file’s group gives them every permission the group has. If the user needs only read and the group has write, the user has more access than intended. A per-user ACL entry grants exactly the needed permission.

The shared-directory problem. A project directory is accessed by developers, reviewers, and auditors, each with a different level of access. The developers need read and write, the reviewers need read, and the auditors need read on the logs only. Groups alone cannot express this; ACLs can.

The per-file problem. Some files are one-off exceptions: a specific user needs access to a specific file, and no group is appropriate. An ACL entry is the answer.

The inheritance problem. A default ACL on a directory makes every file created inside it inherit the ACL. The pattern is the mechanism for a shared directory where every new file has the same access rules.

The audit problem. The getfacl command shows the complete access policy for a file, including the standard bits and the extended entries. The output is the audit record.

The backup problem. The ACLs must be preserved across backups and copies. The rsync and tar tools have options for the ACLs, and the cp -a preserves them. A backup that loses the ACLs loses the access policy.

a. The getfacl command

The getfacl command prints the ACL for a file or directory.

The basic output

getfacl file.txt
# file: file.txt
# owner: alice
# group: developers
# user::rw-
# group::r--
# other::r--

The output has the file name, the owner, the group, and the three standard entries. The user:: entry is the owner’s permission, the group:: entry is the group’s permission, and the other:: entry is the others’ permission.

The extended entries

When the file has an ACL with entries beyond the standard three, the output shows them.

getfacl file.txt
# file: file.txt
# owner: alice
# group: developers
# user::rw-
# user:bob:r--
# user:carol:rw-
# group::r--
# group:auditors:r--
# mask::rw-
# other::r--

The user:bob:r-- entry grants bob read access. The user:carol:rw- entry grants carol read and write. The group:auditors:r-- entry grants the auditors group read. The mask::rw- entry is the mask that limits the effective permissions of the extended entries.

The default ACL

A directory can have a default ACL that is inherited by new files.

getfacl -d dir/
# default:user::rwx
# default:user:bob:rwx
# default:group::r-x
# default:mask::rwx
# default:other::---

The -d flag shows only the default ACL. The default: prefix distinguishes the default entries from the access entries.

The access and default ACLs

A directory can have both an access ACL and a default ACL.

getfacl dir/
# file: dir/
# owner: alice
# group: developers
# user::rwx
# user:bob:rwx
# group::r-x
# mask::rwx
# other::---
# default:user::rwx
# default:user:bob:rwx
# default:group::r-x
# default:mask::rwx
# default:other::---

The access entries apply to the directory itself. The default entries apply to the files created inside it.

The -c option

The -c flag omits the header lines.

getfacl -c file.txt
# user::rw-
# group::r--
# other::r--

The flag is useful for scripting, where the header lines are noise.

The -R option

The -R flag prints the ACLs for a directory and its contents recursively.

getfacl -R /srv/project

The flag walks the tree and prints the ACL for every file and directory.

The -p option

The -p flag keeps the leading / in the path, which is the default.

The –omit-header option

The --omit-header flag is equivalent to -c.

The output format

The output format has three sections.

Section	Lines
Header	`file:`, `owner:`, `group:`
Access entries	`user::`, `user:name:`, `group::`, `group:name:`, `mask::`, `other::`
Default entries	`default:user::`, `default:user:name:`, and so on

The getfacl return

The command exits with status 0 if the ACL was read, and a non-zero status if the file does not exist or the ACL is not readable.

b. The setfacl command

The setfacl command modifies the ACL. It adds, removes, or replaces entries.

The -m option

The -m flag adds or modifies an entry.

setfacl -m u:bob:r-- file.txt
setfacl -m g:auditors:r-- file.txt
setfacl -m o::- file.txt

The u:bob:r-- form adds the user bob with read access. The g:auditors:r-- form adds the group auditors. The o::- form sets the others’ permission to none.

The -x option

The -x flag removes an entry.

setfacl -x u:bob file.txt
setfacl -x g:auditors file.txt

The -x u:bob form removes the entry for the user bob. The -x g:auditors form removes the group entry.

The -b option

The -b flag removes all extended entries and keeps only the standard three.

setfacl -b file.txt

After the command, the file has no extended ACL.

The -k option

The -k flag removes the default ACL from a directory.

setfacl -k dir/

The access ACL is unchanged. Only the default entries are removed.

The -d option

The -d flag sets a default entry for a directory.

setfacl -d -m u:bob:rwx /srv/project

The -d flag applies the entry to the default ACL, and the -m flag modifies it. The combination adds the default entry for bob.

The -R option

The -R flag applies the change recursively.

setfacl -R -m u:bob:r-- /srv/project

The command adds the entry for bob to every file and directory in the tree.

The -n option

The -n flag prevents the mask from being recalculated.

setfacl -n -m u:bob:rwx file.txt

By default, the setfacl command recalculates the mask to the union of the extended entries. The -n flag disables the recalculation.

The –set option

The --set option replaces the entire ACL with the specified entries.

setfacl --set u::rw-,u:bob:r--,g::r--,o::--- file.txt

The command replaces the ACL with the four entries. The --set option is stricter than -m, which adds or modifies.

The mask entry

The mask entry limits the effective permissions of the extended entries. The setfacl command recalculates it by default.

setfacl -m m::rw- file.txt

The m::rw- form sets the mask to read and write. The extended entries cannot grant more than the mask allows.

The mask interaction

A user:bob:rwx entry combined with a mask::r-- produces an effective permission of r-- for bob. The mask limits the effective permission.

The effective permission

The getfacl output shows the effective permission in the effective: field when the mask limits an entry.

getfacl file.txt
# user:bob:rwx     #effective:r--
# mask::r--

The bob entry grants rwx, but the mask limits the effective permission to r--. The comment shows the effective value.

The calculation of the mask

The setfacl command recalculates the mask when an entry is added or modified, unless the -n flag is used. The mask is the union of the permissions of the extended entries and the group entry.

user::rwx           (owner)
user:bob:rw-        (extended)
user:carol:r--      (extended)
group::r-x          (group)
group:auditors:r--  (extended)
mask::rw-           (calculated)
other::r--          (others)

The mask is rw-, which is the union of rw-, r--, r-x, and r--. The mask cannot grant more than the union of the entries.

The default mask

The default ACL has its own mask.

setfacl -d -m m::rwx /srv/project

The default mask applies to the files created in the directory.

The setfacl calculation

Action	Mask recalculated
`-m` add or modify	Yes
`-m` with `-n`	No
`--set`	Yes
`-x` remove	Yes
`-b` remove all	N/A

c. The common ACL patterns

The ACL patterns below are the ones that appear most often. The patterns are the reason the ACLs exist.

The per-user read access

A file that must be readable by a specific user who is not in the group.

setfacl -m u:bob:r-- report.pdf

The bob user can read the file. The rest of the users see the standard permissions.

The per-user write access

A file that must be writable by a specific user.

setfacl -m u:bob:rw- shared.txt

The bob user can read and write. The group and others see the standard permissions.

The per-group access

A file that must be readable by a group.

setfacl -m g:auditors:r-- report.pdf

The auditors group can read. The file’s primary group is unchanged.

The combined entries

Multiple entries are added in one command.

setfacl -m u:bob:r-- -m u:carol:rw- -m g:auditors:r-- report.pdf

The three entries are added, and the mask is recalculated.

The shared directory with default ACL

A directory that grants the group access to everything created inside it.

setfacl -d -m g:developers:rwx /srv/project
setfacl -d -m o::--- /srv/project

The developers group has read, write, and execute on every new file. The others have no access. The default ACL propagates to subdirectories.

The specific user on a shared directory

A directory that grants a specific user access to everything created inside it.

setfacl -d -m u:bob:r-x /srv/project

The bob user has read and execute on every new file. The entry is inherited by the subdirectories.

The recursive change

A change that applies to an entire tree.

setfacl -R -m u:bob:r-- /srv/project

The command walks the tree and adds the entry to every file and directory.

The removal of an entry

The entry is removed with the -x flag.

setfacl -x u:bob /srv/project

The command removes the entry for bob from the directory.

The complete removal

The extended entries are removed with the -b flag.

setfacl -b /srv/project

After the command, the file has only the standard three entries.

The backup and restore

The getfacl and setfacl commands are used together for backup and restore.

getfacl -R /srv/project > project.acl
setfacl --restore=project.acl

The --restore option reads the file produced by getfacl and applies the ACLs. The getfacl output is a valid input for setfacl --restore.

The pattern table

Pattern	Command
Per-user read	`setfacl -m u:bob:r-- file`
Per-user write	`setfacl -m u:bob:rw- file`
Per-group access	`setfacl -m g:auditors:r-- file`
Default ACL	`setfacl -d -m g:developers:rwx dir`
Recursive	`setfacl -R -m u:bob:r-- dir`
Remove entry	`setfacl -x u:bob file`
Remove all	`setfacl -b file`
Backup	`getfacl -R dir > file.acl`
Restore	`setfacl --restore=file.acl`

Complete Example Session

# ============================================
# PART 1: THE STANDARD PERMISSIONS
# ============================================

touch report.pdf
ls -l report.pdf
# -rw-r--r-- 1 alice developers 0 ... report.pdf

getfacl report.pdf
# file: report.pdf
# owner: alice
# group: developers
# user::rw-
# group::r--
# other::r--

# ============================================
# PART 2: THE PER-USER ENTRY
# ============================================

setfacl -m u:bob:r-- report.pdf
getfacl report.pdf
# file: report.pdf
# owner: alice
# group: developers
# user::rw-
# user:bob:r--
# group::r--
# mask::r--
# other::r--

ls -l report.pdf
# -rw-r--r--+ 1 alice developers 0 ... report.pdf
# The + indicates the ACL.

# ============================================
# PART 3: THE MULTIPLE ENTRIES
# ============================================

setfacl -m u:bob:rw- -m u:carol:r-- -m g:auditors:r-- report.pdf
getfacl report.pdf
# user::rw-
# user:bob:rw-
# user:carol:r--
# group::r--
# group:auditors:r--
# mask::rw-
# other::r--

# ============================================
# PART 4: THE MASK LIMIT
# ============================================

setfacl -m m::r-- report.pdf
getfacl report.pdf
# user:bob:rw-      #effective:r--
# mask::r--
# The mask limits the effective permission.

# ============================================
# PART 5: THE DEFAULT ACL
# ============================================

mkdir /srv/project
setfacl -d -m g:developers:rwx /srv/project
setfacl -d -m o::--- /srv/project

getfacl /srv/project
# file: /srv/project
# owner: root
# group: root
# user::rwx
# group::r-x
# other::r-x
# default:user::rwx
# default:group::r-x
# default:group:developers:rwx
# default:mask::rwx
# default:other::---

# ============================================
# PART 6: THE INHERITED ACL
# ============================================

touch /srv/project/file.txt
getfacl /srv/project/file.txt
# file: /srv/project/file.txt
# owner: root
# group: root
# user::rw-
# group::r-x           #effective:r--
# group:developers:rwx #effective:rw-
# mask::rw-
# other::---
# The file inherits the default ACL.

# ============================================
# PART 7: THE RECURSIVE CHANGE
# ============================================

setfacl -R -m u:bob:r-- /srv/project
getfacl -R /srv/project | grep bob
# user:bob:r--
# (in every file)

# ============================================
# PART 8: THE ENTRY REMOVAL
# ============================================

setfacl -x u:bob report.pdf
getfacl report.pdf
# user::rw-
# user:carol:r--
# group::r--
# group:auditors:r--
# mask::rw-
# other::r--

# ============================================
# PART 9: THE COMPLETE REMOVAL
# ============================================

setfacl -b report.pdf
getfacl report.pdf
# user::rw-
# group::r--
# other::r--
# The extended entries are removed.

# ============================================
# PART 10: THE BACKUP AND RESTORE
# ============================================

getfacl -R /srv/project > /root/project.acl
setfacl --restore=/root/project.acl
# The ACLs are restored.

The ten parts showed the standard permissions, the per-user entry, the multiple entries, the mask limit, the default ACL, the inherited ACL, the recursive change, the entry removal, the complete removal, and the backup and restore.

Quick Reference

The getfacl Options

Option	Purpose
`-c`	Omit the header
`-d`	Show the default ACL
`-R`	Recurse into directories
`-p`	Keep the leading `/`
`--omit-header`	Same as `-c`

The setfacl Options

Option	Purpose
`-m`	Add or modify an entry
`-x`	Remove an entry
`-b`	Remove all extended entries
`-k`	Remove the default ACL
`-d`	Set a default entry
`-R`	Recurse
`-n`	Do not recalculate the mask
`--set`	Replace the entire ACL
`--restore`	Restore from a `getfacl` file

The Entry Forms

Form	Meaning
`u::rw-`	The owner
`u:bob:r--`	The user bob
`g::r--`	The group
`g:auditors:r--`	The group auditors
`m::rw-`	The mask
`o::---`	The others
`default:u:bob:r--`	The default entry for bob

The Mask Rules

Rule	Description
Recalculated	On `-m` and `--set`
Not recalculated	With `-n`
Limits	The effective permissions
Effective	Shown in the `#effective:` comment

The Common Patterns

Pattern	Command
Per-user read	`setfacl -m u:bob:r-- file`
Per-user write	`setfacl -m u:bob:rw- file`
Per-group access	`setfacl -m g:auditors:r-- file`
Default ACL	`setfacl -d -m g:developers:rwx dir`
Remove entry	`setfacl -x u:bob file`
Remove all	`setfacl -b file`
Backup	`getfacl -R dir > file.acl`
Restore	`setfacl --restore=file.acl`

Best Practices

✅ Do This:

# Use getfacl to view the ACL.
getfacl file.txt  # ✅

# Use setfacl -m to add an entry.
setfacl -m u:bob:r-- file.txt  # ✅

# Use the default ACL for a shared directory.
setfacl -d -m g:developers:rwx /srv/project  # ✅

# Use the mask to limit the effective permissions.
setfacl -m m::r-- file.txt  # ✅

# Use --set to replace the entire ACL.
setfacl --set u::rw-,u:bob:r--,g::r--,o::--- file.txt  # ✅

# Use -R for a recursive change.
setfacl -R -m u:bob:r-- /srv/project  # ✅

# Back up the ACLs before a change.
getfacl -R /srv/project > project.acl  # ✅

# Restore from the backup.
setfacl --restore=project.acl  # ✅

❌ Don’t Do This:

# Don't forget the mask when adding entries.
setfacl -m u:bob:rwx file.txt  # ⚠️ The mask may limit it

# Don't use the ACL as a replacement for the standard bits.
# The ACL extends the bits, not replaces them.  # ❌

# Don't forget the default ACL is not applied to existing files.
setfacl -d -m g:developers:rwx /srv/project  # ⚠️ New files only

# Don't confuse the access ACL with the default ACL.
# The access ACL applies to the directory itself.  # ❌

# Don't forget the recursive flag.
setfacl -m u:bob:r-- /srv/project  # ⚠️ The directory only

# Don't forget the backup before a large change.
# A wrong ACL can lock out the team.  # ❌

# Don't rely on the ACL on a filesystem that does not support them.
# Check the mount options.  # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
ACL not inherited	No default ACL	Use `-d`
Effective permission lower	The mask limits it	Check the mask
ACL not applied recursively	No `-R`	Add the flag
Entry not removed	Wrong syntax	Use `-x`
ACL on a filesystem that ignores them	Mount option	Check the mount
Backup loses the ACLs	Wrong tool	Use `getfacl` and `setfacl`
The `+` is missing	No extended entries	Add an entry
The mask blocks the entry	The mask is the union	Set the mask explicitly

Real-World Examples

1. View the ACL

getfacl file.txt

2. Add a User Entry

setfacl -m u:bob:r-- file.txt

3. Add a Group Entry

setfacl -m g:auditors:r-- file.txt

4. Set the Default ACL

setfacl -d -m g:developers:rwx /srv/project

5. Recursive Change

setfacl -R -m u:bob:r-- /srv/project

6. Remove an Entry

setfacl -x u:bob file.txt

7. Remove All Extended Entries

setfacl -b file.txt

8. Remove the Default ACL

setfacl -k dir/

9. Backup the ACLs

getfacl -R /srv/project > project.acl

10. Restore the ACLs

setfacl --restore=project.acl

Visual

The ACL Structure

┌────────────────────────────────────────────────────────────┐
│  THE ACL STRUCTURE                                         │
│                                                            │
│  file: report.pdf                                          │
│  owner: alice                                              │
│  group: developers                                         │
│                                                            │
│  ┌──────────────────────────────────────────────────┐     │
│  │  user::rw-          ← the owner (alice)           │     │
│  │  user:bob:r--       ← extended: bob               │     │
│  │  user:carol:rw-     ← extended: carol             │     │
│  │  group::r--         ← the group (developers)      │     │
│  │  group:auditors:r-- ← extended: auditors          │     │
│  │  mask::rw-          ← the mask                    │     │
│  │  other::r--         ← everyone else               │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  The standard entries are the same as the bits.            │
│  The extended entries add the per-user and per-group rules.│
└────────────────────────────────────────────────────────────┘

The Mask

┌────────────────────────────────────────────────────────────┐
│  THE MASK                                                  │
│                                                            │
│  user:bob:rwx                                              │
│  mask::r--                                                 │
│                                                            │
│  ┌──────────────────────────────────────────────────┐     │
│  │  The entry grants rwx.                            │     │
│  │  The mask limits the effective permission to r--. │     │
│  │                                                   │     │
│  │  getfacl shows:                                   │     │
│  │    user:bob:rwx     #effective:r--                │     │
│  │    mask::r--                                      │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  The mask is the upper bound on the extended entries.      │
└────────────────────────────────────────────────────────────┘

The Default ACL

┌────────────────────────────────────────────────────────────┐
│  THE DEFAULT ACL                                           │
│                                                            │
│  /srv/project  (directory)                                 │
│  ┌──────────────────────────────────────────────────┐     │
│  │  default:user::rwx                                │     │
│  │  default:group:developers:rwx                     │     │
│  │  default:mask::rwx                                │     │
│  │  default:other::---                               │     │
│  └────────────────────────┬─────────────────────────┘     │
│                           │                                │
│                           │  New file created             │
│                           v                                │
│  /srv/project/file.txt                                     │
│  ┌──────────────────────────────────────────────────┐     │
│  │  user::rw-                                        │     │
│  │  group:developers:rwx                             │     │
│  │  mask::rw-                                        │     │
│  │  other::---                                       │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  The new file inherits the default ACL.                    │
└────────────────────────────────────────────────────────────┘

The Standard Bits and the ACL

┌────────────────────────────────────────────────────────────┐
│  STANDARD BITS AND ACL                                     │
│                                                            │
│  WITHOUT ACL                                               │
│  ┌──────────────────────────────────────────────────┐     │
│  │  -rw-r--r-- 1 alice developers ... file.txt       │     │
│  │                                                   │     │
│  │  Three classes: owner, group, others.             │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  WITH ACL                                                  │
│  ┌──────────────────────────────────────────────────┐     │
│  │  -rw-r--r--+ 1 alice developers ... file.txt      │     │
│  │                                                   │     │
│  │  The + indicates the extended entries.            │     │
│  │  getfacl shows the full list.                     │     │
│  └──────────────────────────────────────────────────┘     │
│                                                            │
│  The ACL extends the bits. It does not replace them.       │
└────────────────────────────────────────────────────────────┘

Summary

Item	Value
ACL	Access Control List
`getfacl`	View the ACL
`setfacl`	Modify the ACL
`-m`	Add or modify an entry
`-x`	Remove an entry
`-b`	Remove all extended entries
`-d`	Set a default entry
`-R`	Recurse
`mask`	Limits the effective permissions
Default ACL	Inherited by new files

Key takeaways:

An ACL extends the standard permission bits. The three standard entries (user::, group::, other::) are the same as the bits. The extended entries add the per-user and per-group rules. The ls -l output shows a + when an ACL is present.
The getfacl command shows the complete ACL. The output includes the header, the access entries, and the default entries. The -c flag omits the header, the -d flag shows the default ACL, and the -R flag recurses.
The setfacl -m command adds or modifies an entry. The u:bob:r-- form grants bob read access. The g:auditors:r-- form grants the auditors group read access. The o::- form sets the others’ permission.
The setfacl -x command removes an entry. The -b flag removes all extended entries. The -k flag removes the default ACL.
The mask limits the effective permissions of the extended entries. The setfacl command recalculates the mask by default, and the getfacl output shows the effective permission in a comment when the mask limits an entry.
A default ACL on a directory is inherited by new files. The setfacl -d command sets the default entries. The entries propagate to the subdirectories, and the new files receive the same ACL.
The --set option replaces the entire ACL. The -m option adds or modifies, and the --set option replaces. The two are different, and the difference matters.
The ACLs are backed up and restored with getfacl and setfacl. The getfacl -R command produces a file, and the setfacl --restore command reads it. The backup preserves the access policy.

Remember: The access control lists extend the standard permission model with the per-user and per-group entries. The getfacl command shows the list, and the setfacl command modifies it. The -m flag adds or modifies an entry, the -x flag removes it, and the -b flag removes all the extended entries. The mask limits the effective permissions of the extended entries, and the default ACL on a directory is inherited by the new files. The result is a system where a file can grant read access to one user, write access to another, and nothing to the rest, without creating a group for every sharing pattern.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!