How to View and Manage File Permissions and ACLs in macOS Terminal

File access control in macOS is structured upon two distinct security layers: traditional Unix POSIX permissions (read, write, execute across Owner, Group, and Others) and advanced Access Control Lists (ACLs). While standard POSIX mode bits provide baseline ownership boundaries, macOS relies heavily on ACLs to enforce fine-grained permissions for local user accounts, Time Machine snapshots, network file sharing (SMB/AFP), and parental controls. Knowing how to inspect and manipulate both systems via macOS Terminal ensures accurate access configuration without permission conflicts.

Understanding POSIX Permissions vs Access Control Lists (ACLs)

When interacting with the macOS filesystem (APFS or HFS+), files and directories enforce two security tiers:

• POSIX Permissions: The standard 9-bit octal permission string (e.g. -rwxr-xr-- or 754). Every file has exactly one owning user and one owning group.
• ACLs (Access Control Lists): An ordered sequence of Access Control Entries (ACEs) appended to an object. ACLs allow you to grant or deny granular rights (such as readattr, writeattr, delete, append, or directory_inherit) to multiple distinct users and groups simultaneously, overcoming the single-group limitation of POSIX.

How to Inspect File Permissions and ACLs with ls

To inspect standard permissions, run the conventional list command in Terminal:

ls -l /path/to/directory

Look closely at the 11th character of the file mode string (immediately after the read/write/execute bits):

• A plus sign (+) (e.g. drwxr-xr-x+) indicates that the file or folder possesses an active Access Control List.
• An at symbol (@) indicates the presence of extended attributes (such as quarantine flags or metadata tags).

To reveal the exact ACE rules contained within that ACL, pass the -e option to ls:

ls -le /path/to/file

Terminal will display the base file information followed by numbered ACE lines, such as:
0: user:john allow read,write,execute
1: group:everyone deny delete

Adding and Managing ACLs with chmod

In macOS, the standard chmod binary includes extended arguments designed specifically to manage ACL entries:

• Add an ACL Rule: Use the +a flag to append an Access Control Entry. For example, to grant a specific local user read and write rights to a shared project folder:

  chmod +a "user:sarah allow read,write" /path/to/project

• Add an Inherited Directory Rule: To ensure that all subdirectories and new files created inside a folder automatically inherit these rights:

  chmod +a "group:designers allow read,write,file_inherit,directory_inherit" /path/to/folder

• Deny Specific Actions: Explicitly prevent accidental deletion of a critical file while leaving read and edit access intact:

  chmod +a "everyone deny delete" /path/to/critical.docx

Removing and Purging ACLs

When user roles change or permissions become convoluted, you can delete specific ACE rules or wipe the entire ACL structure:

• Delete an Entry by Exact Rule:
  chmod -a "user:sarah allow read,write" /path/to/project
• Delete an Entry by Index Number: Check the rule’s index number using ls -le (for example, index 0), then remove it by reference:

  chmod -a# 0 /path/to/file

• Strip All ACLs Entirely: To strip all Access Control Lists from a file or folder and revert strictly to default POSIX mode bits, use the uppercase -N flag:

  chmod -N /path/to/file

• Recursively Clear ACLs: To remove ACLs across an entire folder tree:

  chmod -R -N /path/to/directory