Linux ACLs with getfacl and setfacl: sharing a folder with one extra user

When basic permissions run out

Basic permissions give one owner and one group. If an auditor needs read access to a log directory owned by the app group, you could add them to the group, but that might grant more than reading logs. An access control list adds named user or group entries to a single file or directory.

A file with an ACL shows a plus sign after its mode in ls -l, like -rw-r-----+. Always check for that plus when a file seems to have mysterious access.

getfacl and setfacl

getfacl file prints the owner, group, each named entry, and the mask. setfacl -m u:auditor:r-x dir adds a named user entry. -d sets default entries that new files in a directory inherit. -x removes one entry and -b removes them all.

The mask entry caps what named users and the group entry can have. If the mask is r--, a named entry with rwx is effectively read-only. getfacl prints “#effective:” next to entries the mask limits.

Snippet

setfacl -m u:auditor:rx /var/log/app
setfacl -d -m u:auditor:r /var/log/app
getfacl /var/log/app
setfacl -x u:auditor /var/log/app

Lab: read-only access for an auditor

Create an auditor account and an application log directory owned by root:app with mode 750. Confirm the auditor cannot list it. Add an access entry and a default entry for the auditor, write a new log file as the app user, and confirm the auditor can read it but not delete it.

Then chmod g-r on the directory and run getfacl. Notice the mask changed and the auditor’s effective rights dropped. chmod on a file with ACLs adjusts the mask, which surprises many administrators.

Snippet

sudo useradd -m auditor
sudo mkdir -p /var/log/app && sudo chown root:app /var/log/app && sudo chmod 750 /var/log/app
sudo setfacl -m u:auditor:rx -d -m u:auditor:r /var/log/app
sudo -u auditor ls /var/log/app
getfacl /var/log/app

Auditing ACLs

Find every file with an ACL under a path with getfacl -R -s -p /srv | grep "^# file". Review named entries the way you review group membership: who, why, and until when.

Backups and copies can drop ACLs unless the tool preserves them, for example rsync -A or tar --acls. A restore that loses ACLs can lock people out or, worse, fall back to broader basic permissions.

Diagram

Granting one user read access with an ACL

Check
Confirm the basic mode blocks the user.
Add
setfacl -m for the directory, -d -m for new files.
Command
```
setfacl -m u:auditor:rx -d -m u:auditor:r /var/log/app
```
Verify
Test as the user and read getfacl, including the mask.
Review
List ACLs periodically and remove expired entries.

Check yourself

1. How does ls -l show that a file has an ACL?

2. A named user entry is rwx but getfacl shows #effective:r--. Why?

3. Which option makes new files in a directory inherit an ACL entry?