Setting and Displaying ACLs

WARNING:

This documentation is a draft and is not meant for production use. Branch: OL10-FSADMIN

Use the setfacl and getfacl commands to set and display ACLs on the file system.

To add or modify the ACL rules for file, use the setfacl command with the following syntax:

sudo setfacl -m rules file ...

ACL rules accept the following forms:

[d:]u: user[: permissions]: Sets the access ACL for the user specified by name or user ID. The permissions apply to the owner if no user is specified.
[d:]g: group[: permissions]: Sets the access ACL for a group specified by name or group ID. The permissions apply to the owning group if no group is specified.
[d:]m[:][: permissions]: Sets the effective rights mask, which is the union of all permissions of the owning group and all user and group entries.
[d:]o[:][: permissions]: Sets the access ACL for other (everyone else to whom no other rule applies).

The permissions are as follows and are used with the chmod command.

The d: prefix is used to apply the rule to the default ACL for a directory.

To display a file's ACL, use the getfacl command, for example:

sudo getfacl foofile

The output of this command would be as follows:

# file: foofile
# owner: bob
# group: bob
user::rw-
user::fiona:r--
user::jack:rw-
user::jill:rw-
group::r--
mask::r--
other::r--

If extended ACLs are active on a file, the ls -l command displays a plus sign (+) after the permissions:

-rw-r--r--+ 1 bob bob  105322 Apr 11 11:02 foofile

The following examples show how to set and display ACLs for directories and files:

To grant read access to a file or directory by a user:
```
sudo setfacl -m u:user:r file
```
To display the name, owner, group, and ACL for a file or directory:
```
sudo getfacl file
```
To remove write access to a file for all groups and users by changing the effective rights mask rather than the ACL:
```
sudo setfacl -m m::rx file
```
Note that the -x option removes rules for a user or group.
To remove the rules for a user from the ACL of a file:
```
sudo setfacl -x u:user file
```
To remove the rules for a group from the ACL of a file:
```
sudo setfacl -x g:group file
```
To remove all the extended ACL entries from a file or directory, specify the -b option:
```
sudo setfacl -b file
```

To copy the ACL of file f1 to file f2:

sudo getfacl f1 | setfacl --set-file=- f2

To set a default ACL of read and execute access for other on a directory:
```
sudo setfacl -m d:o:rx directory
```
To promote the ACL settings of a directory to default ACL settings that can be inherited:
```
sudo getfacl --access directory | setfacl -d -M- directory
```
to remove the default ACL from a directory, specify the -k option:
```
sudo setfacl -k directory
```

For more information, see the acl(5), setfacl(1), and getfacl(1) manual pages.