Linux Access Control Lists for Granular Permissions

Access Control Lists (ACLs) in Linux provide a flexible, fine-grained permission mechanism that extends beyond the traditional standard permissions assigned to the owner, group, and others (UGO). This article explains how Linux implements ACLs to overcome the limitations of the classic permission model, covering filesystem support, the underlying architecture, essential management commands (getfacl and setfacl), default inheritance behaviors, and permission evaluation rules.

The Limitation of Traditional Permissions

Traditional Linux permissions define rights for only three entities: the file owner (u), the assigned group (g), and everyone else (o). If a system administrator needs to grant read and write access to a secondary user without making them the file owner, or grant access to a second group without adding unauthorized users to the primary group, standard permissions cannot accommodate the request. ACLs resolve this limitation by allowing administrators to assign distinct read, write, and execute permissions to any arbitrary user or group.

Filesystem Support and Prerequisites

ACL implementation relies on Extended Attributes (xattr) stored within the filesystem's metadata blocks (inodes). Modern Linux filesystems—including ext4, XFS, and Btrfs—have native ACL support enabled by default.

If operating on older systems or specific network mounts, the filesystem must be mounted with the acl option in /etc/fstab:

UUID=xxxx-xxxx /data ext4 defaults,acl 0 2

The user-space tools required to inspect and modify ACLs are provided by the acl package, available across all major Linux distributions. When a file has an active ACL, standard utilities like ls -l represent this by appending a plus sign (+) to the permission string (e.g., -rw-rwxr--+).

Core Commands: `getfacl` and `setfacl`

Linux manages ACLs using two primary command-line utilities: getfacl to read ACLs and setfacl to modify them.

1. Viewing ACLs with `getfacl`

Running getfacl on a file displays the owner, the primary group, standard permissions, and any granular rules applied:

getfacl document.txt

Output format:

# file: document.txt
# owner: alice
# group: staff
user::rw-
user:bob:r--
group::r--
mask::r--
other::---

2. Modifying ACLs with `setfacl`

The -m (modify) flag applies explicit permissions using the syntax [u|g]:[name]:[permissions].

Grant a specific user access:
```
setfacl -m u:bob:rw document.txt
```
Grant a specific group access:
```
setfacl -m g:finance:r-x document.txt
```
Remove a specific ACL entry (-x):
```
setfacl -x u:bob document.txt
```
Remove all extended ACL entries (-b):
```
setfacl -b document.txt
```

Default ACLs and Directory Inheritance

Standard ACLs only apply to existing files. For directories where newly created files must automatically inherit permissions, Linux uses Default ACLs.

Default ACLs are defined using the -d flag:

setfacl -d -m g:marketing:rwx /shared/projects

Any new file or subdirectory created inside /shared/projects automatically receives the specified permissions for the marketing group, preventing the need for manual permission updates or automated scripts.

The ACL Mask and Permission Precedence

Linux ensures safety and compatibility with legacy software through an entity called the mask.

The Mask: The mask defines the maximum effective permissions for all named users, named groups, and the owning group. If a user has rwx in their ACL entry, but the mask is set to r--, the effective permission granted is only read (r). The mask automatically recalculates when adding new entries, but it can be set explicitly using setfacl -m m::rx filename.
Evaluation Order: When a process attempts to access a file, the Linux kernel checks permissions in a strict order and stops at the first match:
1. File Owner: If the process belongs to the file owner, standard owner permissions apply.
2. Named User: If the process UID matches a specific user ACL, that rule applies (restricted by the mask).
3. Group Match: If the process belongs to the owning group or any named ACL groups, the union of matching group permissions applies (restricted by the mask).
4. Other: If no other rules match, standard "other" permissions apply.