setfacl and getfacl: Linux Access Control Lists

Quick take: ACLs give fine-grained permissions beyond owner/group/other. Use setfacl -m u:alice:rw file to grant alice read-write, getfacl file to view the ACL, and -d to set defaults that new files inherit.

Introduction

The standard Linux permission model has only three classes — owner, group, and others — which is sometimes too coarse. Access Control Lists (ACLs) add per-user and per-group permissions on top. The setfacl command sets them and getfacl displays them, giving precise control over who can access what.

Syntax

The basic syntax of the setfacl and getfacl command is:

setfacl [OPTIONS] ACL FILE
getfacl FILE

Common Options and Parameters

The most useful options and parameters for the setfacl and getfacl command:

Practical Examples

Real setfacl and getfacl commands you can run today:

# Grant a user read-write on a file
setfacl -m u:alice:rw report.txt
# Grant a group read-execute on a directory
setfacl -m g:devs:rx /srv/project
# View a file's ACL
getfacl report.txt
# Set a default ACL so new files inherit it
setfacl -d -m g:devs:rwx /srv/project
# Apply recursively
setfacl -R -m g:devs:rx /srv/project
# Remove all ACLs
setfacl -b report.txt

Tips and Best Practices

• A + at the end of ls -l permissions (rw-r--r--+) signals that a file has an ACL — run getfacl to see it.
• Use a default ACL (-d) on a shared directory so every new file automatically inherits the right group access.
• ACLs require the filesystem to be mounted with ACL support, which is the default on modern ext4 and xfs.

Final Thoughts

ACLs, managed with setfacl and getfacl, extend Linux permissions beyond the basic three classes to per-user and per-group rules. They shine on shared directories, especially with default ACLs that propagate access to new files. When owner/group/other is not enough, ACLs provide the precision — look for the + in ls -l to spot them.