What it does
Normal permissions have one owner and one group. With setfacl you add more: u:carol:rx for a user, g:account:rwx for a group. A default ACL (-d) on a directory is copied to new files and directories in it.
The mask is the maximum for all named users and groups and the owning group. setfacl sets it automatically; chmod g=... on a file with an ACL changes the mask.
Only the owner or root may change an ACL. XFS and ext4 on RHEL support ACLs without extra mount options.
How to write it
setfacl [-bkndRLPvh] [{-m|-x} ACL] [{-M|-X} FILE] FILE...
setfacl --set=ACL FILE...
setfacl --restore=FILEMain parts
u:USER:PERMS- Rights for a named user (u::PERMS = the owner).
g:GROUP:PERMS- Rights for a named group (g::PERMS = the owning group).
m::PERMS- The mask.
o::PERMS- Others.
d:ENTRY- A default entry (same as -d).
PERMS- r, w, x, X (x only for folders) or - ; numbers 0–7 work too.
Options 18
Most used
--restore=FILE- Restore ACLs from a
getfacl -Rdump.
Nothing matches this filter.
Examples 11
$ run as a normal user# run as root (or with sudo)
1Give one user read access
setfacl -m u:carol:r report.txtcarol may read; the normal mode stays.
2Give a group full access to a folder
setfacl -m g:account:rwx /srv/salesA second team without changing the owning group.
3Make new files inherit the rights
setfacl -d -m g:account:rwX /srv/salesWithout -d only existing entries change.
4Existing files and new files together
setfacl -R -m g:account:rX /srv/sales setfacl -d -m g:account:rX /srv/salesFirst the tree, then the default for later files.
5Remove one entry
setfacl -x u:carol report.txtOnly carol's entry goes.
6Remove all ACLs
setfacl -R -b /srv/salesBack to the normal permissions.
7Let a service read a log folder
setfacl -R -m u:promtail:rX /var/log/httpd setfacl -d -m u:promtail:rX /var/log/httpdA log shipper reads logs without being root or in the group (least privilege).
8Let a user only pass through a folder
setfacl -m u:carol:x /home/lisacarol can reach a file inside (if she may read it) but cannot list the folder.
9Test before you change
setfacl --test -m u:carol:rw report.txtShows the new ACL only.
10Restore a backup of ACLs
setfacl --restore=/root/srv-acl.txtThe dump from
getfacl -R.11Fix rights cut by the mask
setfacl -m m::rwx /srv/sales/plan.txtThe mask limits named entries; set it back to rwx.
Nothing matches this filter.
Watch out
- The mask limits named users and groups. Check
#effective:in getfacl. - A default ACL on a folder replaces the umask for new files there.
- Backups need ACL support:
tar --acls,rsync -A.
Exit codes
0 | Done. |
1 | Error. |