---
title: acl
---

Checking the ACL list with `getfacl`
Once you've set the acl with setfacl it is common sense to check if it took effect, in order to do so you will need to use the `getfacl` command.

``` bash
 root@testvm:/var/tmp# getfacl appdir/
 # file: appdir/
 # owner: root
 # group: appgroup
 user::rwx
 group::rwx
 group:testusers:r--
 mask::rwx
 other::r-x
```

The output of getfacl is pretty self explanatory, you can see the rule that we added below the standard group entry.

Identifying files/directories that have ACL's
While the standard unix permissions are displayed with the ls -l command; the defined ACL's are a little more verbose and are not a part of the long listing. The command ls will tell you if a file or directory does have acl's, it's just not that obvious.

``` bash
 root@testvm:/var/tmp# ls -la | grep appdir
 drwxrwxr-x+  2 root appgroup 4096 May 27 10:45 appdir
```

As you can see there is now a + at the end of the directories permissions. This + is the indicator that this file or directory has acl's, from here you can use the getfacl command to see what they are.


Examples of Usage
Now that we have a filesystem that supports ACL's and we know how to set and review the ACL's lets run through a few examples of ACL usage.

Use Cases
Removing all acl entries from a file or directory
Set test users to have read access to all files in a directory
Set the same acl changes recursively
Set the same acls on all newly created files automatically
Set testuser1 to have read, write and execute access to the appuser1 directory
Set all users to have read, write and execute access to the shared directory
Remove the acl for testuser1 on appuser1 directory
Removing all acl entries from a file or directory

Before we start messing with acl's in my directory I want to clear out all of the acl's it previously had. Doing this one by one can be a bit of a pain, its a good thing the setfacl command gives you the ability to remove all acl's on a specified file or directory. This can be accomplished using the -b option of setfacl.

``` bash
 root@testvm:/var/tmp# getfacl appdir/
 # file: appdir/
 # owner: root
 # group: appgroup
 user::rwx
 group::rwx
 group:testusers:r--
 mask::rwx
 other::r-x
```

``` bash
 root@testvm:/var/tmp# setfacl -b appdir/
 root@testvm:/var/tmp# getfacl appdir/
 # file: appdir/
 # owner: root
 # group: appgroup
 user::rwx
 group::rwx
 other::r-x
```

Keep in mind when using the -b option that this will remove all of the acl rules on the specified directory.

Set testusers to have read access to all files in the appdir directory

This is a pretty basic acl, we want the testusers group to have read access to all files in the appdir directory.

``` bash
 root@testvm:/var/tmp# setfacl -m g:testusers:r appdir/
 root@testvm:/var/tmp# getfacl appdir
 # file: appdir
 # owner: root
 # group: appgroup
 user::rwx
 group::rwx
 group:testusers:r-- mask::rwx
 other::r-x
```

Set the changes recursively

The appdir has 2 sub directories appdir/appuser1 and appdir/appuser2 in this case we want the acl rules set above to apply to these directories as well. This can easily be accomplished by adding the -R (recursive) option in setfacl. This works exactly like the recursive option for chmod.

``` bash
 root@testvm:/var/tmp# setfacl -Rm g:testusers:r appdir/
 root@testvm:/var/tmp# getfacl appdir/*
 # file: appdir/appuser1
 # owner: appuser1
 # group: appgroup
 user::rwx
 group::r-x
 group:testusers:r-- mask::r-x
 other::r-x

 # file: appdir/appuser2
 # owner: appuser2
 # group: appgroup
 user::rwx
 group::r-x
 group:testusers:r-- mask::r-x
 other::r-x
```

Set the same acl's on all newly created files automatically

The -d (default) option in setfacl is extremely useful; this option will allow us to set an acl rule to be the default rule. When this is set on a directory this makes all new files or directories created within that directory inherit the same acl rules.

``` bash
 root@testvm:/var/tmp# setfacl -dm g:testusers:r appdir/
 root@testvm:/var/tmp# touch appdir/file1
 root@testvm:/var/tmp# mkdir appdir/dir1
 root@testvm:/var/tmp# getfacl appdir/*
 # file: appdir/appuser1
 # owner: appuser1
 # group: appgroup
 user::rwx
 group::r-x
 group:testusers:r--
 mask::r-x
 other::r-x

 # file: appdir/appuser2
 # owner: appuser2
 # group: appgroup
 user::rwx
 group::r-x
 group:testusers:r--
 mask::r-x
 other::r-x

 # file: appdir/dir1
 # owner: root
 # group: root
 user::rwx
 group::rwx
 group:testusers:r-- mask::rwx
 other::r-x
 default:user::rwx
 default:group::rwx
 default:group:testusers:r-- default:mask::rwx
 default:other::r-x

 # file: appdir/file1
 # owner: root
 # group: root
 user::rw-
 group::rwx            #effective:rw-
 group:testusers:r-- mask::rw-
 other::r--
```

As you can see dir1 also have the default acl rules as appdir, yet appuser1 does not. This is because we did not set the default recursively; this can be done by using the -R option.

``` bash
 root@testvm:/var/tmp# setfacl -Rdm g:testusers:r appdir/
 root@testvm:/var/tmp# getfacl appdir/appuser1
 # file: appdir/appuser1
 # owner: appuser1
 # group: appgroup
 user::rwx
 group::r-x
 group:testusers:r--
 mask::r-x
 other::r-x
 default:user::rwx
 default:group::r-x
 default:group:testusers:r--
 default:mask::r-x
 default:other::r-x
```

Set testuser1 to have read, write and execute access to the appuser1 directory

While the user testuser1 is in the testusers group and has read access to the appuser1 directory he does not have write access. In this case we want to give him write access without giving the rest of the testusers write access. This can be done using acl's by specifying a specific user rather than a group.

``` bash
 root@testvm:/var/tmp# setfacl -m u:testuser1:rwx appdir/
 root@testvm:/var/tmp# getfacl appdir/
 # file: appdir/
 # owner: root
 # group: appgroup
 user::rwx
 user:testuser1:rwx group::rwx
 group:testusers:r--
 mask::rwx
 other::r-x
 default:user::rwx
 default:group::rwx
 default:group:testusers:r--
 default:mask::rwx
 default:other::r-x
```

The user testuser1 can now create files in the appdir1 directory.

``` bash
 root@testvm:/var/tmp# sudo -u testuser1 touch appdir/file2
 root@testvm:/var/tmp# ls -la appdir/file2
 -rw-rw-r--+ 1 testuser1 testusers 0 May 27 12:17 appdir/file2
```

Set all users to have read, write and execute to the shared directory

We have now given users and groups permissions on directories and files, but what happens when we want all users to have access to a directory? Adding every users name or group could get tedious, in this case we can set the "other" or "world" permissions so that all users on a system can access this directory.

``` bash
 root@testvm:/var/tmp# setfacl -m o::rwx shared
 root@testvm:/var/tmp# getfacl shared/
 # file: shared/
 # owner: root
 # group: root
 user::rwx
 group::r-x
 other::rwx
```

You might be asking yourself right now "wait a minute, did setfacl just set the permissions to 757?"; why yes it did! ACL's are just an extension of the standard unix permissions, in this case because we are not specifying a user or group; setfacl will simply just change the mode of the file. Tricky, yes I know.

Remove the acl for testuser1 on appuser1 directory

Unlike the -b option that removes all acl's on a directory or file the -x option will only remove the specified rule. This is useful for when you maybe fat fingered an acl rule and don't want to completely remove all of the acl rules attached to that file/directory.

``` bash
 root@testvm:/var/tmp# setfacl -x u:testuser1 appdir/
 root@testvm:/var/tmp# getfacl appdir/
 # file: appdir/
 # owner: root
 # group: appgroup
 user::rwx
 group::rwx
 group:testusers:r--
 mask::rwx
 other::r-x
 default:user::rwx
 default:group::rwx
 default:group:testusers:r--
 default:mask::rwx
 default:other::r-x
```