This documentation contains instructions to use POSIX Access Control Lists (ACLs) under Linux-based operating systems.
Users and groups can be stacked, unlike with the simpler UNIX Discretionary Access Controls (DACs) system, making it possible to have multiple users and groups able to access a file descriptor, rather than 1 of each, without allowing system-wide access.
POSIX ACLs can be used alongside UNIX DACs, within the constraints of how both interact with one another.
In order for POSIX ACLs to be set and take effect, the filesystem in use must support POSIX ACLs. Specifications for the target filesystem should be consulted regarding POSIX ACLs support. Supported filesystems include, but are not limited to, XFS, Ext4, ZFS, and Btrfs, under the condition that their respective POSIX ACLs functionality is enabled.
Within this documentation, # is used to denote running the command as the root user, and
$ is used to denote running the command as an unprivileged user. The lowest-privileged user
able to run the commands will be used for each command. Some shells may present different characters for
privileged and unprivileged users than used in this documentation; the shell's documentation should be
consulted if this is true for the system being used.
For the complete POSIX ACLs documentation, the manpages via man getfacl and
man setfacl should be consulted, for viewing and setting POSIX ACLs, respectively.
To view the currently-set POSIX ACLs for a file descriptor, such as a directory or file, the user can run the following command:
$ getfacl <file descriptor>
This command lists the users and groups with POSIX ACLs set against them, alongside other users and the ACL mask. The ACL mask is used as the maximum-allowed permissions, and overrides more-permissive permissions set for a user/group (shown as effective permissions when the user/group has more-permissive permissions set than the ACL mask).
When POSIX ACLs are in effect against a file descriptor, a + character will be
displayed to the right of the permissions block when viewing the long-form directory listing, such
as via ls -l or similar.
When a POSIX-ACL mask is in effect, the UNIX DAC group will report the mask permission bits, rather than the typical DAC group permission bits.
POSIX ACLs can be set against a file descriptor for a user via the following command:
$ setfacl --modify user:<user>:<permissions> <file descriptor>
POSIX ACLs can be set against a file descriptor for a group via the following command:
$ setfacl --modify group:<group>:<permissions> <file descriptor>
POSIX ACLs can be set against a file descriptor for other users via the following command:
$ setfacl --modify other::<permissions> <file descriptor>
-m can be used as the short-form variant of --modify. u
can be used in place of user, g can be used in place of
group, and o can be used in place of other.
Permissions are set as with UNIX DACs, consisting of read (r), write
(w), and execute (x) bits. Examples of POSIX ACL-compliant permission
values are r-x (read and execute), rw- (read and write), and
rwx (read, write, and execute).
Setting permissions for other is equivalent via both UNIX DACs and POSIX ACLs.
My personal recommendation is to set the UNIX DAC owner user and group to the owner of the file
descriptor, with permissions set to 700 for directories and executable files, and
set to 600 for non-executable files, utilising POSIX ACLs to modify the access
permissions for other users and groups.
To remove a POSIX ACL against a file descriptor for a user, the user can run the following command:
$ setfacl --remove user:<user> <file descriptor>
To remove a POSIX ACL against a file descriptor for a group, the user can run the following command:
$ setfacl --remove group:<group> <file descriptor>
To remove all POSIX ACLs against a file descriptor, the user can run the following command:
$ setfacl --remove-all <file descriptor>
-x can be used as the short-form variant of --remove, and
-b can be used as the short-form variant of --remove-all.