How to Use the ‘setfacl’ Command for Advanced POSIX Access Control Lists

The Limitation of Standard File Permissions

If you’ve spent any time managing a Linux server, you are intimately familiar with the chmod and chown commands. These tools rely on the standard UNIX permission model, which divides file access into three strict buckets: the Owner, the Group, and Others (everyone else).

But what happens in a complex corporate environment? Suppose you have a highly sensitive financial report at /srv/finance/Q3_Earnings.pdf. You want the “Finance” group to have read/write access. But you also want a specific user from the Marketing department (jdoe) to have Read-Only access, and a specific user from the Legal department (msmith) to have Read/Write access.

The standard UNIX chmod model completely falls apart here. You cannot assign permissions to multiple distinct users or groups on a single file.

To solve this, Linux relies on POSIX Access Control Lists (ACLs), managed by the incredibly powerful setfacl command.

1. Enabling ACLs on Your Filesystem

Before you can use setfacl, your filesystem must support it. Most modern Linux filesystems (ext4, xfs, btrfs) have ACL support enabled by default. You can verify this by checking if the acl package is installed on your server (sudo apt install acl on Ubuntu/Debian).

2. Assigning Specific User Permissions

Let’s solve our scenario. The file is currently owned by the finance group. We need to grant Read-Only access to jdoe.

setfacl -m u:jdoe:r /srv/finance/Q3_Earnings.pdf

Breaking down the flags:

• -m (Modify): We are modifying the ACLs, not overwriting them.
• u:jdoe:r: We are targeting a User (jdoe) and granting Read access.

Now, let’s grant the lawyer, msmith, Read and Write access:

setfacl -m u:msmith:rw /srv/finance/Q3_Earnings.pdf

3. Auditing the Hidden Permissions with getfacl

If you run a standard ls -l on the file, you won’t see the specific users you just added. Instead, you will see a tiny + symbol at the end of the permissions string (e.g., -rw-rw-r--+). That plus sign is Linux’s subtle warning that complex ACLs are active.

To actually view the hidden rules, you must use the companion command, getfacl.

getfacl /srv/finance/Q3_Earnings.pdf

The output will clearly list every single user and their specific granular access rights.

4. Setting Default ACLs for Directories

The true power of setfacl shines when managing entire directories. Suppose you want a shared folder where every single new file created instantly inherits the correct ACLs.

setfacl -d -m g:finance:rwx /srv/finance/shared_drive

Breaking down the flags:

• -d (Default): This forces the rule to act as a template. Any new file created inside shared_drive will permanently inherit Read/Write/Execute permissions for the finance group, completely bypassing the user’s standard umask settings.

Conclusion

The standard UNIX permission model is a blunt instrument. The setfacl command acts as a scalpel. By enabling POSIX ACLs, systems administrators can deploy intricate, highly granular security policies that satisfy complex compliance requirements without having to artificially nest hundreds of arbitrary user groups.