thelinuxvault blog

Access Control Lists (ACL) in Linux

In the realm of Linux file systems, traditional Unix permissions (read, write, execute for user, group, and others) offer a basic level of access control. However, these permissions have limitations when it comes to more complex scenarios, such as granting specific access rights to multiple individual users or groups without adding them to the main group of a file. This is where Access Control Lists (ACL) come into play. ACLs provide a more fine - grained approach to file and directory permissions, allowing administrators to set detailed access rules.

2026-06

Table of Contents#

  1. What are Access Control Lists (ACL)
  2. Enabling ACL Support
  3. ACL Concepts and Terminology
  4. Working with ACLs: Commands
    • getfacl
    • setfacl
  5. Common Practices and Use Cases
  6. Best Practices
  7. Troubleshooting ACLs
  8. Conclusion
  9. References

1. What are Access Control Lists (ACL)#

Access Control Lists (ACL) in Linux are an extension of the traditional Unix file permissions model. While the standard Unix permissions allow you to define access rights for the owner of the file, the group associated with the file, and all other users, ACLs can assign permissions to additional users and groups.

For example, let's say you have a shared project directory. The traditional permissions can set general access for the project group, but if you want a specific user (who is not part of the main project group) to have read - only access to some files in the directory, you can use ACLs to achieve this targeted access control.

2. Enabling ACL Support#

Before using ACLs, you need to ensure that your file system supports them and that they are enabled. Most modern Linux file systems like ext4 support ACLs, but they may not be enabled by default.

Mounting with ACL Support#

To enable ACL support for an existing file system when mounting, you can modify the /etc/fstab file. For example, if you want to enable ACL on the /home partition which is of type ext4, you can add the acl option to the mount entry.

# Before modification
UUID=12345678-1234-1234-1234-123456789abc /home ext4 defaults 0 2
 
# After modification
UUID=12345678-1234-1234-1234-123456789abc /home ext4 defaults,acl 0 2

After making the change, remount the partition:

sudo mount -o remount,acl /home

Checking ACL Support Post - Mount#

You can verify that ACL support is enabled by using the mount command. The output for the relevant partition should show the acl option.

mount | grep /home

3. ACL Concepts and Terminology#

Access Entries#

An ACL consists of one or more access entries. Each access entry defines the access rights for a specific user or group. There are different types of access entries:

  • User Entry: Defines permissions for a specific user. For example, you can set special permissions for the user john on a file.
  • Group Entry: Defines permissions for a specific group. For example, the developers group may have different permissions on a project directory.
  • Mask Entry: The mask entry limits the effective permissions of all user and group entries. It's a kind of upper - bound for non - default entries.
  • Other Entry: Similar to the "others" category in traditional Unix permissions, it defines the permissions for users who do not match any of the other entries.

Permission Flags#

The permission flags in ACLs are similar to those in traditional Unix permissions:

  • r for read
  • w for write
  • x for execute

4. Working with ACLs: Commands#

getfacl#

The getfacl command is used to display the Access Control List of a file or directory.

Example Usage:

# Display the ACL of a file
getfacl /path/to/file.txt
 
# Display the ACL of a directory in a recursive manner
getfacl -R /path/to/directory

The output of getfacl will show details about the owner, group, and all the access entries of the file or directory. For example:

# file: file.txt
# owner: user1
# group: group1
user::rw-
group::r--
other::r--
user:john:r--

setfacl#

The setfacl command is used to modify the Access Control List of a file or directory.

Adding a User Entry:

# Give user 'john' read - only access to a file
setfacl -m u:john:r-- /path/to/file.txt

Adding a Group Entry:

# Give the 'developers' group read - write access to a directory
setfacl -m g:developers:rw- /path/to/directory

Removing an Entry:

# Remove the ACL entry for user 'john' from a file
setfacl -x u:john /path/to/file.txt

Removing All Non - Default Entries:

# Remove all non - default ACL entries from a directory
setfacl -b /path/to/directory

5. Common Practices and Use Cases#

Shared Project Directories#

In a software development project, different teams may need different levels of access to the project files. For example, the development team may need full read - write - execute access, while the quality assurance team may only need read - only access. You can use ACLs to set these specific permissions without having to create complex group memberships.

# Give developers full access
setfacl -R -m g:developers:rwx /project/directory
 
# Give QA team read - only access
setfacl -R -m g:qa:r-- /project/directory

Multi - Tenant Environments#

In a multi - tenant hosting environment, different customers may need access to their own files and directories on the server. ACLs can be used to isolate each customer's files and give them appropriate access rights.

# Give customer1 full access to their directory
setfacl -m u:customer1:rwx /customers/customer1

6. Best Practices#

Document ACL Changes#

Whenever you make changes to ACLs, it's important to document them. This helps in auditing and troubleshooting. You can maintain a log file that records the date, user, and the nature of the ACL change.

Regular Auditing#

Periodically audit the ACLs on your system to ensure that the access rights are still appropriate. Over time, user roles may change, and old ACL entries may need to be removed or modified.

Limit the Use of Mask Entry Changes#

Changing the mask entry can have a significant impact on the effective permissions of other entries. Only make changes to the mask entry when absolutely necessary and understand the implications fully.

7. Troubleshooting ACLs#

Permission Issues#

If a user is experiencing unexpected permission issues, check the following:

  • Use getfacl to verify the ACL settings of the file or directory.
  • Make sure the mask entry is not overly restrictive.
  • Check if there are any inheritance rules that might be affecting the permissions.

ACL Inheritance#

Sometimes, ACL inheritance can lead to unexpected behavior. If you have set ACL inheritance on a directory, make sure that the default entries are what you intended. You can use setfacl to modify or remove default entries.

# Remove default ACL entries from a directory
setfacl -k /path/to/directory

8. Conclusion#

Access Control Lists (ACL) in Linux provide a powerful and flexible way to manage file and directory permissions. By going beyond the traditional Unix permissions model, ACLs allow for more fine - grained access control, which is essential in complex environments. With proper understanding and application of ACL commands, common practices, and best practices, administrators can effectively manage access rights and ensure the security and integrity of their systems.

9. References#

  • Linux Man Pages: The getfacl and setfacl man pages provide in - depth information about the commands. You can access them using man getfacl and man setfacl on your Linux system.
  • "The Linux Documentation Project": Offers comprehensive guides on Linux file systems and permissions, including ACLs.
  • Red Hat Documentation: Provides detailed information on ACLs in the context of Red Hat Enterprise Linux. You can find the relevant documentation at https://access.redhat.com/documentation.