Lesson 3.38: ACLs: precise access without loosening permissions
Classic permissions have one owner, one group and everyone else. When a second group needs access, the usual shortcuts are dangerous: make the files world-readable, or add people to the service's own group. POSIX access control lists (ACLs) add named users and groups to a file's permissions, with a mask that caps them, and default ACLs that new files inherit. In the lab the audit team needs read-only access to the shop API's logs; you grant it with setfacl, verify it as an auditor, and confirm they can't write.
15 min
You will learn to
- Explain the limits of owner/group/other
- Read ACLs with getfacl
- Grant group access with setfacl -m
- Use default ACLs for new files
- Explain the ACL mask
Key terms
- ACL
- Access control list: extra permission entries for named users and groups on a file.
- getfacl / setfacl
- Read and change ACLs.
- Mask
- The upper limit for named users, named groups and the owning group.
- Default ACL
- An ACL on a directory that new files and subdirectories inherit.
- X (capital)
- Execute permission only for directories (and files already executable).
← Absolute and relative paths · All lessons · Reading and fixing SELinux denials →