The Limitations of Standard Linux Permissions
Every Linux system administrator eventually hits the limits of standard file permissions. The traditional chmod system (rwx) is simple but extremely rigid: it only allows you to assign permissions to three distinct categories: the single Owner, the single Group, and “Everyone Else” (Others).
What happens when you have a file that needs to be read-only for the Sales team, read-write for the specific user “John”, and completely hidden from the user “Sarah”? The traditional User/Group/Other model cannot accommodate this complex requirement without creating messy, nested groups that are impossible to manage.
This is where Access Control Lists (ACLs) come in. The setfacl (Set File Access Control Lists) command allows you to assign unique, highly granular permissions to any number of specific users or groups on a single file or directory, completely bypassing the limitations of traditional Linux permissions.
Step 1: Checking Existing ACLs
Before you modify permissions, you should view the current access control list for a file using the getfacl command.
getfacl financial_report.pdf
This will output a list showing the standard owner and group permissions. If no advanced ACLs have been set, it will mirror the standard ls -l output.
Step 2: Adding Permissions for a Specific User
Let’s grant the user “john” read and write access to the file, without changing the file’s primary owner or affecting anyone else’s access.
The syntax uses the -m (modify) flag, followed by a rule format: type:name:permissions.
setfacl -m u:john:rw financial_report.pdf
- -m: Modifies the ACL.
- u: Specifies we are adding a rule for a User (use
gfor Group). - john: The specific username.
- rw: The permissions to grant (read and write).
If you run ls -l financial_report.pdf now, you will notice a small + (plus) sign at the end of the permissions block (e.g., -rw-r--r--+). This plus sign is Linux’s way of warning you that hidden ACL rules are active on this file.
Step 3: Adding Permissions for a Specific Group
Similarly, you can grant read-only access to an entire group (like the “sales” group) without making them the primary owning group of the file.
setfacl -m g:sales:r financial_report.pdf
Step 4: Denying Access to a Specific User
ACLs aren’t just for granting access; they are excellent for explicitly blocking a specific person. If you want to ensure the user “sarah” cannot read or write the file, you remove the rwx letters entirely, leaving it blank (or using a hyphen).
setfacl -m u:sarah:--- financial_report.pdf
Step 5: Removing ACL Rules
If John moves to a different department and no longer needs access, you should remove his specific rule rather than modifying the entire file.
Use the -x (remove) flag, specifying the user or group you want to delete.
setfacl -x u:john financial_report.pdf
Step 6: Wiping All ACLs (Starting Fresh)
If an ACL list has become too complex and you want to strip all custom rules, returning the file to its standard traditional permissions, use the -b (remove all) flag.
setfacl -b financial_report.pdf
This will instantly delete all specific user and group rules, and the + sign will disappear from your ls -l output.