Traditionally, three permission sets are defined for each file object on a Linux system. These sets include the read (r), write (w), and execute (x) permissions for each of three types of users—the file owner, the group, and other users. In addition to that, it is possible to set the set user id, the set group id, and the sticky bit. This lean concept is fully adequate for most practical cases. However, for more complex scenarios or advanced applications, system administrators formerly had to use a number of workarounds to circumvent the limitations of the traditional permission concept.
ACLs can be used as an extension of the traditional file permission concept. They allow the assignment of permissions to individual users or groups even if these do not correspond to the original owner or the owning group. Access control lists are a feature of the Linux kernel and are currently supported by ReiserFS, Ext2, Ext3, JFS, and XFS. Using ACLs, complex scenarios can be realized without implementing complex permission models on the application level.
So, let’s start:
user1@raspberrypi ~ $ mkdir directory
user1@raspberrypi ~ $ ls -lad directory/
drwxrwxr-x 2 user1 user1 4096 Feb 15 10:42 directory/
With getfacl directory, check the initial state of the ACL. This gives information like:
user1@raspberrypi ~ $ getfacl directory/
# file: directory/
# owner: user1
# group: user1
user::rwx
group::r-x
other::r-x
to add user(u) user2 with write(rw) access on a “directory” directory you need to enter the following command
#setfacl -m u:user2:rw directory
With getfacl directory, check the initial state of the ACL. This gives information like:
user1@raspberrypi ~ $ getfacl directory/
# file: directory/
# owner: user1
# group: user1
user::-w-
user:user2:rw-
group::r-x
mask::rwx
other::r-x
to add group(g) users with read(r) access on a “directory” directory you need to enter the following command
#setfacl -m g:users:w directory
With getfacl directory, check the initial state of the ACL. This gives information like:
user1@raspberrypi ~ $ getfacl directory/
# file: directory/
# owner: user1
# group: user1
user::-w-
user:user2:rw-
group::r-x
group:users:-w-
mask::rwx
other::r-x
to add others(o) with read(r) access on a “directory” directory you need to enter the following command
#setfacl -m o::r directory
With getfacl directory, check the initial state of the ACL. This gives information like:
user1@raspberrypi ~ $ getfacl directory/
# file: directory/
# owner: user1
# group: user1
user::-w-
user:user2:rw-
group::r-x
group:users:-w-
mask::rwx
other::r--
to remove user(u) user2 access from a “directory” directory you need to enter the following command:
#setfacl –x u:user2 directory/
With getfacl directory, check the initial state of the ACL. This gives information like:
user1@raspberrypi ~ $ getfacl directory/
# file: directory/
# owner: user1
# group: user1
user::-w-
group::r-x
group:users:-w-
mask::rwx
other::r--