Linux ACL: setfacl, getfacl, and Permission Workflow on ext4 and xfs

A POSIX ACL extends the classic owner/group/other model. Instead of only three permission classes, you can attach rules for named users and named groups on a single file or directory.

The kernel still stores base mode bits (what chmod sets), but when ACLs exist it also reads extended attributes — on ext4 and xfs you will see system.posix_acl_access. ls -l adds a + after the mode when those extended entries are present.

getfacl /data/shared/report.txt

Sample lines:

user::rw-
user:alice:r--
group::r--
mask::r--
other::r--

A strong answer is:

"POSIX ACLs let me grant per-user or per-group access on one inode without changing owner or opening the file to everyone. On Linux I inspect with getfacl and change with setfacl on ACL-capable filesystems like ext4 and xfs."

The mask (mask::) is the ceiling for named users, named groups, and the owning group entry. Even if user:bob:rwx is listed, effective access is the intersection of that entry and the mask.

getfacl -e /data/file

When the mask is tight you may see:

user:bob:rwx	#effective:r--
mask::r--

That #effective:r-- line is what the kernel actually enforces. Fix it by raising the mask (setfacl -m m::rwx) or by letting setfacl recalculate the mask (omit -n).

A strong answer is:

"The mask caps effective rights for named users, named groups, and the owning group — I use getfacl -e to see effective permissions when access looks wrong despite a permissive user line."

An access ACL applies to the file or directory itself — who can read, write, or traverse it right now.

A default ACL exists only on directories. It does not change existing files; it tells the kernel which ACL entries to copy onto new files and subdirectories created inside.

sudo setfacl -m u:alice:r-x -d -m u:alice:r-- /data/shared
getfacl /data/shared

Look for lines starting with default: in getfacl output. Missing defaults are why a user can access the folder but not files created by someone else.

A strong answer is:

"Access ACL controls the object itself; default ACL on a directory defines inheritance for new children only — I set both when building a team folder on ext4 or xfs."

setfacl is for everyday administration: add one user (-m), remove one entry (-x), strip everything (-b), or set directory defaults (-d). Each call changes only what you specify.

chacl replaces the entire ACL from a single rule string — closer to a reset or generated policy. A second chacl run does not merge; it overwrites again.

A strong answer is:

"I use setfacl for incremental ACL edits and chacl only when I need to replace the whole ACL or reset to a known template — chacl is not safe for small tweaks."

No on GNU/Linux. chmod +a is macOS/BSD syntax for attaching ACL rules. Linux distributions ship POSIX ACL tools in the acl package instead.

chmod +a

On Ubuntu 25.04 that fails — there is no +a operand. The portable Linux equivalent is:

sudo setfacl -m u:alice:r-- /path/to/file
getfacl /path/to/file

Keep using chmod for u+rw, g+r, and numeric modes; use setfacl when you need a named principal.

A strong answer is:

"GNU chmod on Linux does not implement chmod +a — that is BSD/macOS. I use setfacl -m for per-user ACL entries and getfacl to verify them on ext4 or xfs."

Yes, when the filesystem is mounted with ACL support — default on Ubuntu for both ext4 and xfs.

Check ext4 mount options:

tune2fs -l /dev/ROOT_DEVICE | grep "Default mount options"

You should see acl in the list. On xfs, ACLs are part of the standard feature set. tmpfs and other filesystems may lack ACL support; setfacl then fails with Operation not supported.

A strong answer is:

"ext4 and xfs on Ubuntu support POSIX ACLs out of the box — I confirm with tune2fs or mount options if setfacl returns operation not supported."