Linux Filesystem ACLs: A Practical How-To

Filesystem Access Control Lists (ACLs) extend the traditional Linux permission model (owner/group/others) by letting you grant permissions to specific users or groups without changing the file’s owning group. This guide shows you how to view, set, and remove ACLs using the setfacl and getfacl commands, and how to make them stick for new files.

What You’ll Need

A Linux system with an ext4, XFS, Btrfs, or other ACL-supporting filesystem (most modern distros enable ACLs by default).
Root or sudo access to install packages and modify files you don’t own.
The acl package installed (on Debian/Ubuntu: sudo apt install acl; on RHEL/Fedora: sudo dnf install acl).
Basic familiarity with the command line and standard chmod permissions.

Step-by-Step

Check if your filesystem supports ACLs. Run mount | grep ' / ' (or the mount point you care about) and look for the acl option. If it’s not there, you may need to remount with sudo mount -o remount,acl / (temporary) or add acl to the options field in /etc/fstab and reboot. Most modern distros have it on by default.
Install the ACL utilities. On Debian/Ubuntu: sudo apt install acl. On RHEL/Fedora: sudo dnf install acl. On Arch: sudo pacman -S acl. Verify with getfacl --version.
View existing ACLs. Use getfacl /path/to/file to display the ACL entries. The output shows the owner, group, and any named users/groups, plus the mask and default ACLs (for directories).
Grant a specific user read/write access. Use setfacl -m u:username:rw /path/to/file. This adds an entry for that user without affecting the owner or others. Replace rw with r, w, x, or a combination like rx.
Grant a specific group read/execute access. Use setfacl -m g:groupname:rx /path/to/file. This is useful for shared project directories.
Remove a specific ACL entry. Use setfacl -x u:username /path/to/file to remove that user’s entry, or setfacl -x g:groupname /path/to/file for a group.
Set a default ACL on a directory. So that new files inside the directory inherit the ACL, use setfacl -m d:u:username:rwx /path/to/directory. The d: prefix sets the default ACL. New files will get the specified permissions for that user, subject to the file creation mask.
Copy ACLs from one file to another. Use getfacl /source/file | setfacl --set-file=- /target/file to replicate the ACL exactly. This is handy when setting up multiple files with the same permissions.
Remove all ACLs from a file. Use setfacl -b /path/to/file to strip all extended ACL entries, returning to standard Unix permissions.
Verify the changes. Always run getfacl /path/to/file after making changes to confirm the entries are as intended.

Common Mistakes

Forgetting the mask. The mask limits the effective permissions of named users and groups. If you set u:alice:rwx but the mask is r-x, Alice’s effective permissions are only r-x. Check the mask line in getfacl output and adjust with setfacl -m m::rwx if needed.
Using -m instead of -x to remove. -m modifies or adds; -x removes. Using -m u:alice: with no permissions will not remove the entry—it will just set blank permissions.
Not using the d: prefix for defaults. If you want new files in a directory to inherit an ACL, you must set the default ACL with d:u:username:.... Without it, only the directory itself gets the ACL, and new files won’t have it.
Assuming ACLs override chmod. They don’t. The chmod command can change the mask and remove ACL entries. If you run chmod 600 on a file with a named user ACL, the mask will be updated to rw-, possibly limiting that user’s access.
Ignoring the effective permissions. The getfacl output shows both the requested permissions and the effective permissions (after mask). Always check the effective column.

Tips

Use getfacl -R to view ACLs recursively on a directory tree: getfacl -R /path/to/dir.
Back up ACLs before major changes. You can dump all ACLs with getfacl -R /path > acl_backup.txt and restore with setfacl --restore=acl_backup.txt.
Test with a non-privileged user. Create a test user and try accessing the file to confirm the ACL works as expected, rather than assuming from the output.
Remember that ACLs are per-filesystem. If you copy a file to a filesystem that doesn’t support ACLs (like FAT32), the ACLs are lost.
Combine with groups for efficiency. Instead of adding many individual users, create a group, add users to it, and set a group ACL. This is easier to manage.

Troubleshooting

ACL commands not found. Install the acl package as described in Step 2. If you’re on a minimal system, you may need to enable the universe/multiverse repositories on Ubuntu.
Filesystem doesn’t support ACLs. If getfacl returns an error like “Operation not supported”, your filesystem may not have ACLs enabled. Remount with the acl option or check if the filesystem type (e.g., NFS) supports ACLs at all.
ACLs don’t seem to take effect. Check the mask. If the mask is too restrictive, the effective permissions will be lower than what you set. Also verify that the user is not blocked by the file’s group permissions—ACLs are additive, but the mask applies.
New files don’t inherit ACLs. Ensure you set the default ACL with d: prefix on the directory. Also note that the file creation mask (umask) can restrict the default ACL—the effective permissions are the intersection of the default ACL and the umask.
ACLs lost after copying or moving files. By default, cp without -p or --preserve does not copy ACLs. Use cp -p or rsync -A to preserve ACLs.
Permission denied even with ACL. The file’s owner and group still apply. If the owner has no permissions and the ACL grants the user, the user should get access, but if the group has no permissions and the user is in that group, the ACL entry should override. If not, check the mask and the order of entries.

Frequently Asked Questions

Do ACLs replace chmod?

No. ACLs extend the traditional model. The owner, group, and other permissions still exist and are shown as the first three entries in getfacl. ACLs add named users and groups on top of that.

Can I set an ACL for a user that doesn’t exist yet?

Yes, you can set an ACL for a username that isn’t currently on the system. However, it won’t have any effect until a user with that name is created. It’s better to use a group for future-proofing.

What’s the difference between an ACL and a default ACL?

An ACL applies to the file or directory itself. A default ACL (only on directories) is inherited by new files and subdirectories created inside that directory. Default ACLs are prefixed with d:.

How do I see the effective permissions for a user?

Run getfacl /path/to/file and look at the effective: field next to each named user or group entry. It shows what permissions actually apply after the mask is considered.

Can ACLs be used on NFS mounts?

It depends on the NFS server and client configuration. Modern NFSv4 supports NFSv4 ACLs, which are different from POSIX ACLs. For NFSv3, POSIX ACLs may work if both sides support them, but it’s not guaranteed. Check your NFS documentation.

How do I remove all ACLs from a directory tree?

Use setfacl -bR /path/to/directory to remove all ACL entries recursively. This resets files to standard Unix permissions.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →