Access Control Lists: setfacl, getfacl, default ACLs and the mask

The plan: webteam keeps editing the monthly sales reports, and arjun, who joined from the web side, may read them but not change the numbers. You’ll do it with an ACL and leave /srv/projects/reports in place for later lessons. Take a snapshot of rocky01 first.

As before, sudo -iu priya opens a shell as priya and exit comes back. If getfacl isn’t found, install the acl package: sudo dnf install acl on Rocky or sudo apt install acl on Ubuntu.

1Check the tools and the starting point

Run this:

getfacl --version
ls -ld /srv/projects

You should see something like this:

getfacl 2.3.2

drwxrws---. 3 root webteam 89 Oct 27 11:40 /srv/projects

The dot after the mode means “SELinux label, no ACL”. When a file gets an ACL, that dot becomes a +.

✅ Checkpoint: getfacl prints a version and /srv/projects is drwxrws--- root webteam.

2priya creates the reports folder

Run this:

sudo -iu priya
mkdir /srv/projects/reports
chmod 2770 /srv/projects/reports
echo "Oct sales: 1,240 orders" > /srv/projects/reports/oct-sales.txt
chmod 660 /srv/projects/reports/oct-sales.txt
ls -ld /srv/projects/reports
ls -l /srv/projects/reports
exit

You should see something like this:

drwxrws---. 2 priya webteam 27 Oct 27 11:42 /srv/projects/reports
total 4
-rw-rw----. 1 priya webteam 24 Oct 27 11:42 oct-sales.txt

The folder and the file got group webteam from the SGID bit you set in Lesson 18, and the modes give the whole team read and write.

✅ Checkpoint: reports is drwxrws--- and oct-sales.txt is -rw-rw----, both with group webteam.

3See the problem: arjun can change the numbers

Run this:

sudo -iu arjun
echo "arjun: checked" >> /srv/projects/reports/oct-sales.txt
cat /srv/projects/reports/oct-sales.txt
exit

You should see this:

Oct sales: 1,240 orders
arjun: checked

arjun is in webteam, so the group bits let him write. Taking him out of the group would also take away his access to the rest of /srv/projects, which he still needs, and making a new group for “everyone except arjun” doesn’t scale.

✅ Checkpoint: arjun’s line was added to oct-sales.txt.

4Read the ACL before you change it

Run this:

getfacl /srv/projects/reports

You should see this:

getfacl: Removing leading '/' from absolute path names
# file: srv/projects/reports
# owner: priya
# group: webteam
# flags: -s-
user::rwx
group::rwx
other::---

Without extra entries, getfacl shows the normal mode in ACL form. The flags line -s- is the SGID bit. The first line is only a notice that the paths in the output are relative, which is what lets you restore them somewhere else later.

✅ Checkpoint: You can match each getfacl line to a part of drwxrws---.

5Give arjun read-only access

Run this:

sudo setfacl -R -m u:arjun:rX /srv/projects/reports
getfacl -R /srv/projects/reports
ls -ld /srv/projects/reports
ls -l /srv/projects/reports

You should see something like this:

getfacl: Removing leading '/' from absolute path names
# file: srv/projects/reports
# owner: priya
# group: webteam
# flags: -s-
user::rwx
user:arjun:r-x
group::rwx
mask::rwx
other::---

# file: srv/projects/reports/oct-sales.txt
# owner: priya
# group: webteam
user::rw-
user:arjun:r--
group::rw-
mask::rw-
other::---

drwxrws---+ 2 priya webteam 27 Oct 27 11:42 /srv/projects/reports
total 4
-rw-rw----+ 1 priya webteam 39 Oct 27 11:43 oct-sales.txt

-R walks the whole tree and -m modifies (adds) an entry. Capital X gives x on folders, so arjun can enter them, but not on plain files. setfacl also created the mask:: lines for you, and both listings now end their modes with a +.

Try it yourself: build read-only and read-write ACL commands in the Command Builder.

✅ Checkpoint: getfacl shows user:arjun:r-x on the folder and user:arjun:r-- on the file.

6Test as arjun

Run this:

sudo -iu arjun
cat /srv/projects/reports/oct-sales.txt
echo "arjun: again" >> /srv/projects/reports/oct-sales.txt
touch /srv/projects/reports/arjun.txt
exit

You’ll get this:

Oct sales: 1,240 orders
arjun: checked
-bash: /srv/projects/reports/oct-sales.txt: Permission denied
touch: cannot touch '/srv/projects/reports/arjun.txt': Permission denied

He can read but can’t append or create files, even though webteam has rw on both. The named entry for arjun matched first, so his group membership was never checked. priya and the rest of the group still have full rights.

✅ Checkpoint: cat works, while the append and the touch both give “Permission denied”.

7Add a default ACL for new files

First see the gap. priya adds November’s file and arjun tries it:

sudo -iu priya
echo "Nov sales: draft" > /srv/projects/reports/nov-sales.txt
chmod 660 /srv/projects/reports/nov-sales.txt
getfacl -p /srv/projects/reports/nov-sales.txt
exit
sudo -iu arjun
echo "arjun: edited" >> /srv/projects/reports/nov-sales.txt && echo "arjun wrote to nov-sales.txt"
exit

You’ll get this:

# file: /srv/projects/reports/nov-sales.txt
# owner: priya
# group: webteam
user::rw-
group::rw-
other::---

arjun wrote to nov-sales.txt

The -m from step 5 only touched files that existed then. Fix the new file and add a default entry so it doesn’t happen again:

sudo setfacl -R -m u:arjun:rX /srv/projects/reports
sudo setfacl -R -d -m u:arjun:rX /srv/projects/reports
getfacl /srv/projects/reports

You should see this:

getfacl: Removing leading '/' from absolute path names
# file: srv/projects/reports
# owner: priya
# group: webteam
# flags: -s-
user::rwx
user:arjun:r-x
group::rwx
mask::rwx
other::---
default:user::rwx
default:user:arjun:r-x
default:group::rwx
default:mask::rwx
default:other::---

Now priya creates December’s file without any chmod, and arjun tries it:

sudo -iu priya
echo "Dec sales: draft" > /srv/projects/reports/dec-sales.txt
ls -l /srv/projects/reports
getfacl -p /srv/projects/reports/dec-sales.txt
exit
sudo -iu arjun
cat /srv/projects/reports/dec-sales.txt
echo "arjun: edited" >> /srv/projects/reports/dec-sales.txt
exit

You should see something like this:

total 12
-rw-rw----+ 1 priya webteam 17 Oct 27 11:50 dec-sales.txt
-rw-rw----+ 1 priya webteam 31 Oct 27 11:48 nov-sales.txt
-rw-rw----+ 1 priya webteam 39 Oct 27 11:43 oct-sales.txt
# file: /srv/projects/reports/dec-sales.txt
# owner: priya
# group: webteam
user::rw-
user:arjun:r-x	#effective:r--
group::rwx	#effective:rw-
mask::rw-
other::---

Dec sales: draft
-bash: /srv/projects/reports/dec-sales.txt: Permission denied

dec-sales.txt got arjun’s entry from the default ACL. The default entry says r-x, but the program asked for 0666, so the mask became rw- and arjun’s effective right is r--. Notice also that the file is 660 even though priya’s umask would normally give 644: with a default ACL, the umask is ignored.

✅ Checkpoint: dec-sales.txt has a + and arjun can read it but not write to it.

8Back up the ACLs and restore them

Run this:

cd /srv/projects
sudo getfacl -R reports > ~/reports-acl.txt
head -n 10 ~/reports-acl.txt
sudo setfacl -b reports/oct-sales.txt
ls -l reports/oct-sales.txt
sudo setfacl --restore=$HOME/reports-acl.txt
ls -l reports/oct-sales.txt
cd

You should see something like this:

# file: reports
# owner: priya
# group: webteam
# flags: -s-
user::rwx
user:arjun:r-x
group::rwx
mask::rwx
other::---
default:user::rwx

-rw-rw----. 1 priya webteam 39 Oct 27 11:43 reports/oct-sales.txt
-rw-rw----+ 1 priya webteam 39 Oct 27 11:43 reports/oct-sales.txt

setfacl -b removed the whole ACL (the + disappeared) and --restore put it back from the saved text. Because the paths in the file are relative, run the restore from the same folder you ran getfacl in. Save a file like this before any big permission change at work.

✅ Checkpoint: oct-sales.txt shows a + again after the restore, and ~/reports-acl.txt is kept as your backup.