ACLs — Rights for One More User

Owner, group, others: three slots. Sometimes you need a fourth — your report, readable by ana too, without giving it to a whole group or to everyone. ACLs (access control lists) add rights for users and groups by name.

ls -l /srv/reports/q3.txt

-rw-r----- 1 student student 52 Nov  1 09:00 /srv/reports/q3.txt

ana isn't in the group student, so:

sudo -u ana cat /srv/reports/q3.txt

cat: /srv/reports/q3.txt: Permission denied

getfacl — see it

getfacl /srv/reports/q3.txt

# file: srv/reports/q3.txt
# owner: student
# group: student
user::rw-
group::r--
other::---

Every file has these three entries: they're its mode, written another way.

setfacl -m — add an entry

setfacl -m u:ana:r /srv/reports/q3.txt
getfacl /srv/reports/q3.txt

user::rw-
user:ana:r--
group::r--
mask::r--
other::---

u:ana:r — user ana may read. For a group: g:webteam:rw. ls -l now shows a + after the mode:

-rw-r-----+ 1 student student 52 Nov  1 09:00 /srv/reports/q3.txt

mask is the most any named user or group may get. chmod g-r on a file with an ACL lowers the mask — getfacl then shows #effective: next to what was cut.

Default ACLs — for files not made yet

On a folder, -d sets a default ACL: every new file inside starts with it.

setfacl -d -m u:ana:rw /srv/reports
touch /srv/reports/q4.txt
getfacl /srv/reports/q4.txt

user:ana:rw-

Taking it away

💡 cp doesn't copy an ACL (cp -a does): a copy gets its new folder's default ACL. tar leaves ACLs out unless you add --acls.