s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

getfacl

Show the access control lists (ACLs) of files and directories.

Level
Everyday Linux
Group
Permissions
Needs root
No
Package
acl

What it does

getfacl shows the owner, group and normal permissions plus the extra ACL entries: rights for named users and groups, the mask, and default entries that new files inherit. A + after the mode in ls -l tells you a file has an ACL.

The output format can be used to restore ACLs with setfacl --restore.

How to write it

getfacl [-aceEsRLPtpndvh] FILE...

Options 14

Most used

-a, --access
Show only the access ACL.
-d, --default
Show only the default ACL.
-c, --omit-header
Do not show the comment lines (file, owner, group).
-e, --all-effective
Show the effective rights of all entries.
-E, --no-effective
Do not show effective rights.
-s, --skip-base
Skip files that have only the normal permissions.
-R, --recursive
List the whole tree.
-L, --logical
Follow symbolic links to directories.
-P, --physical
Do not follow symbolic links.
-t, --tabular
Show a table.
-p, --absolute-names
Keep the leading / in names.
-n, --numeric
Show UIDs and GIDs as numbers.
-v, --version
Show the version.
-h, --help
Show help.

Examples 10

$ run as a normal user# run as root (or with sudo)

  1. 1Show the ACL of a folder

    getfacl /srv/sales
# file: srv/sales
# owner: root
# group: sales
# flags: -st
user::rwx
user:carol:r-x
group::rwx
group:account:r-x
mask::rwx
other::---
default:user::rwx
default:group::rwx
default:group:account:r-x
default:mask::rwx
default:other::---

    flags -st = SGID and sticky; default lines are for new files.

  2. 2See which files have an ACL

    ls -l /srv/sales
drwxrws--T+ 2 root sales 22 Oct 25 11:00 /srv/sales

    The + means an ACL.

  3. 3Only the extra entries

    getfacl -cs /srv/sales/*

    Skips files without ACL and the header.

  4. 4Effective rights after the mask

    getfacl /srv/sales/new.txt
group:account:r-x		#effective:r--

    The mask removes x: account can only read.

  5. 5Back up all ACLs of a tree

    getfacl -R /srv > /root/srv-acl.txt

    Restore with setfacl --restore=/root/srv-acl.txt.

  6. 6Only the default ACL

    getfacl -d /srv/sales

    What new files will get.

  7. 7Copy an ACL to another file

    getfacl plan.txt | setfacl --set-file=- report.txt

    Same ACL on report.txt.

  8. 8Numbers instead of names

    getfacl -n /srv/restore

    Helps when users from another server do not exist here.

  9. 9Audit folders with extra access (security)

    getfacl -R -s -p /srv 2>/dev/null | grep -E '^(# file|user:|group:)'

    Lists who got extra rights beyond the normal mode.

  10. 10Table view

    getfacl -t /srv/sales

    Access and default in columns.

Watch out

  • cp and mv keep ACLs only with cp -a (or --preserve=all); tar needs --acls.

Exit codes

0 :: Done. 1 :: Error.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man getfacl

Open the man page (linux.die.net)man7.org