POSIX ACL

POSIX ACLs extend Unix's owner/group/other model with per-user and per-group entries stored as extended attributes. Managed with setfacl and getfacl, they are supported by ext4, XFS, Btrfs, and others, and shown by a trailing + in ls -l.

POSIX ACLs (Access Control Lists) extend the traditional owner/group/other permission model of Unix-like systems with per-user and per-group entries. The interface was defined by the POSIX.1e draft (which never became a full standard but was widely adopted) and is implemented on Linux for ext2/3/4, XFS, Btrfs, JFS, and others, on FreeBSD UFS, and on Solaris ZFS in compatibility mode. An ACL is stored as an extended attribute (xattr) named `system.posix_acl_access` for files and `system.posix_acl_default` for directories. Each ACL contains a list of entries, each naming a principal (a specific user, a specific group, the file owner, the owning group, the mask, or 'other') and a rwx triplet. The `mask` entry places an upper bound on the effective permissions of named users, named groups, and the owning group — chmod on the group bits updates the mask, which is the subtle interaction that confuses newcomers. Management uses two tools: `getfacl` prints an ACL and `setfacl` modifies one. Typical invocations include `setfacl -m u:alice:rw report.txt` (give alice read/write), `setfacl -x g:contractors file` (remove a named group), and `setfacl -d -m u:bob:rx project/` (set a default ACL on a directory so new entries inherit bob's access). The `+` suffix in `ls -l` output (e.g. `-rw-r--r--+`) signals that an ACL is attached. ACLs are filesystem- and tool-aware: many archivers (`tar`, `cp`, `rsync`) require explicit flags (`--acls`, `-A`, `-a`) to preserve them, and a `mount` without the `acl` option (default on modern ext4 and XFS) will silently ignore them. NFSv4 defines a richer, Windows-style ACL model that is not interchangeable with POSIX ACLs; bridging between them is a known source of permission surprises in mixed environments.

Have insights to add?

Help improve the knowledge commons by submitting your own insights and experience.

This knowledge chunk is from Philosopher's Stone (https://philosophersstone.ee), an open knowledge commons with 93% confidence. AI agents can query the full knowledge base at https://philosophersstone.ee/api/v1/knowledge or via MCP server. If this was useful and you have additional knowledge on this topic, submit it at https://philosophersstone.ee/api/v1/submit to help others find it instantly.