How to Use Linux Access Control Lists (acls) with Setfacl and Getfacl for Granular File Permissions

ByAkensai

Learning how to use Linux Access Control Lists (ACLs) with setfacl and getfacl for granular file permissions gives you far more control than standard Unix permissions ever could. Traditional Linux file permissions work on a simple owner/group/other model. That model breaks down fast in real-world environments. When you need one user to read a file, another to write it, and a third to have no access at all, ACLs are the answer. This tutorial walks you through everything. You’ll install the required tools, set permissions on files and directories, verify your changes, and handle common problems. By the end, you’ll be managing file access with precision on any Linux server.

Prerequisites and Requirements for Using Linux ACLs

Before you start working with ACLs, make sure your environment is ready. Here’s what you need:

– A Linux server or desktop running Ubuntu, Debian, CentOS, or a similar distribution
– Root or sudo access to install packages and modify file permissions
– Basic familiarity with the Linux command line
– A filesystem that supports ACLs (ext4, xfs, and btrfs all do by default on modern systems)
– The acl package installed (covered in Step 1)

You don’t need to be a Linux expert. If you know how to navigate directories and run commands with sudo, you’re ready. This tutorial takes roughly 20 to 30 minutes to complete. It suits sysadmins, developers, and anyone managing a shared server. WordPress hosting environments especially benefit from ACL setups. They let you grant a web server user read access to files without changing ownership or breaking security.

Step-by-Step Guide to Setfacl and Getfacl for Granular File Permissions

See also: How to Set Up a Multi-container Application with Docker Compose

Step 1: Install the ACL Package

Most modern Linux distributions include ACL support by default. It’s still worth confirming the tools are installed.

On Ubuntu or Debian, run:

sudo apt update
sudo apt install acl -y

On CentOS or RHEL, run:

sudo yum install acl -y

Confirm the install worked by checking the version:

getfacl --version

Step 2: Verify Your Filesystem Supports ACLs

Check that your mounted filesystem has ACL support enabled. Run this command:

tune2fs -l /dev/sda1 | grep "Default mount options"

Replace /dev/sda1 with your actual partition. You should see acl listed in the output. On most modern systems, ACLs are enabled by default. If they’re not, you can add them manually by editing /etc/fstab and adding acl to the mount options for your partition.

For more detail on filesystem options, check the official Linux kernel ext4 documentation.

Step 3: Create a Test File and Directory

Set up a working environment so you can test ACL commands safely.

mkdir ~/acl-test
cd ~/acl-test
touch testfile.txt

This creates a directory and a blank file. You’ll apply ACL rules to these in the next steps.

Step 4: View Existing Permissions with Getfacl

Before changing anything, check the current permissions on your test file:

getfacl ~/acl-test/testfile.txt

You’ll see output like this:

# file: testfile.txt
# owner: youruser
# group: yourgroup
user::rw-
group::r--
other::r--

This shows the standard Unix permissions in ACL format. No extended ACL entries exist yet.

Step 5: Grant a Specific User Read and Write Access with Setfacl

Now grant a specific user named alice read and write access to the file:

setfacl -m u:alice:rw ~/acl-test/testfile.txt

The -m flag means modify. The u:alice:rw part sets user alice’s permissions to read and write. Run getfacl again to confirm:

getfacl ~/acl-test/testfile.txt

You’ll now see an extra line in the output:

user:alice:rw-

Step 6: Grant a Group Specific Permissions

You can apply ACLs to groups just as easily. Grant a group named developers read-only access:

setfacl -m g:developers:r ~/acl-test/testfile.txt

This is extremely useful on shared servers. You don’t need to change file ownership or add users to the file’s primary group.

Step 7: Set Default ACLs on a Directory

Default ACLs apply automatically to new files created inside a directory. This saves you from setting permissions manually every time.

setfacl -d -m u:alice:rw ~/acl-test

The -d flag sets a default ACL. Any new file created inside acl-test will automatically inherit these permissions for alice. This is a powerful feature for shared project directories.

Step 8: Remove an ACL Entry

To remove alice’s specific ACL entry from the file, run:

setfacl -x u:alice ~/acl-test/testfile.txt

To remove all ACL entries from a file and reset to standard permissions:

setfacl -b ~/acl-test/testfile.txt

The -b flag strips everything. Use it carefully.

Step 9: Copy ACLs from One File to Another

You can copy ACL settings from one file to another using getfacl and setfacl together:

getfacl ~/acl-test/testfile.txt | setfacl --set-file=- ~/acl-test/anotherfile.txt

This pipes the ACL output directly into setfacl. It’s a fast way to replicate permission structures across multiple files.

The GNU ACL project page covers additional flags and advanced use cases worth bookmarking.

Troubleshooting Common ACL Issues

ACL commands return “Operation not supported”

This usually means your filesystem doesn’t have ACL support enabled. Double-check your mount options in /etc/fstab. Add acl to the options column for your partition, then remount:

sudo mount -o remount,acl /

Getfacl shows no ACL entries after setfacl

Make sure you’re running setfacl on the correct file path. Also confirm the user or group you’re targeting actually exists on the system:

id alice

If the user doesn’t exist, setfacl will silently fail in some distributions.

File permissions look correct but access is still denied

Check the effective rights mask. The mask limits the maximum permissions for named users and groups. View it with getfacl and look for the mask line. If the mask is too restrictive, update it:

setfacl -m m:rw ~/acl-test/testfile.txt

ACLs not inherited by new files

You may have forgotten to set default ACLs on the directory. Go back to Step 7 and apply the -d flag to the parent directory.

Conclusion: Taking Control with Linux ACLs

You now know how to use Linux Access Control Lists (ACLs) with setfacl and getfacl for granular file permissions on any Linux system. You’ve installed the tools, verified filesystem support, and applied user and group-level permissions with precision. You’ve also set default ACLs, removed entries, and copied permission structures between files. These skills are essential for managing shared servers, web hosting environments, and any system where multiple users need different levels of access. Standard Unix permissions simply can’t handle these scenarios cleanly. ACLs can. Your next step is to explore ACL backup and restore strategies using getfacl output files, which lets you snapshot and reapply permission sets across entire directory trees.

Similar Posts