Linux Kernel – Advanced Filesystem ACLs Beyond Traditional RWX and POSIX ACL

This is kind of a broad topic and a little too much to cover here. I'll refer you to the POSIX Access Control Lists on Linux whitepaper put together by Andreas Grünbacher of the SuSE Labs. It does a pretty good job of covering the subject and breaking it down so you understand how ACLs work.

Your example

Now let's take a look at your example and break it down.

• group (sales)
• members of sales group (bob, joe)

Now let's break down the permissions on file /home/foo/docs/foo.txt. ACLs also encapsulate the same permissions that most people should be familiar with on Unix, mainly the User, Group, and Other bits. So let's pull those out first.

user:: r--
group::r--
other::---

These would typically look like this in an ls -l:

$ ls -l /home/foo/docs/foo.txt
-r--r----- 1 jane executives 24041 Sep 17 15:09 /home/foo/docs/foo.txt

You can see who owns the file and what the group is with these ACL lines:

# owner: jane
# group: executives

So now we get into the nitty gritty of ACLs:

user:bob:rw-
user:joe:rwx
group:sales:rwx

This is showing that user bob has rw, while user joe has rwx. There is also a group which also has rwx similar to joe. These permissions are as if the user column in our ls -l output had 3 owners (jane, bob, and joe) as well as 2 groups (executives & sales). There is no distinction other than they are ACLs.

Lastly the mask line:

mask::rwx

In this case we're not masking anything, it's wide open. So if users bob and joe have these lines:

user:bob:rw-
user:joe:rwx

Then those are their effective permissions. If the mask were like this:

mask::r-x

Then their effective permissions would be like this:

user:bob:rw-    # effective:r--
user:joe:rwx    # effective:r-x

This is a powerful mechanism for curtailing permissions that are granted in a wholesale way.

NOTE: The file owner and others permissions are not affected by the effective rights mask; all other entries are! So with respect to the mask, the ACL permissions are second class citizens when compared to the traditional Unix permissions.

References

• getfacl(1) - Linux man page
• POSIX Access Control Lists on Linux whitepaper