Filesystem/Access Control List Guide

Extended Access Control Lists (ACLs) are one of the more important features on multiuser systems. They facilitate more control over files than do the basic POSIX User, Group, and Other permissions.

POSIX basic ACL
For instance:

For example:

drwxr-xr-x 2 apache  apache       135 Dec 11 17:48 apache2

What is missing?

1. What happens if more than one user needs control of this directory? One solution is to add these users to the "apache" group. However, these users would then have access to everything the "apache" group has access. This is not what we want.

2. What happens if we need another group to have read/write access to this directory but no other users? In the same way, we can add all the other group users and the "apache" user to another group and let them have access to said group.

But what happens if you want to allow this group to read but not to write?

POSIX Basic ACL has its limitations. "Extended ACL" fixes many of these issues.

Kernel
Each filesystem must include support for extended access control from the kernel before it can be used by the application.

Enable the one(s) needed:

Save your changes and recompile your kernel and boot from it.

Emerge
Now emerge the ACL tools to start using ACL:

ext2/3/4 /etc/fstab with ACL support
Some filesystems like xfs and ext4 enable extended ACL by default when mounted.

Other filesystems may require extra mount options to enable extended ACL. Just add the ACL options in :

Re-mount the partition with the acl option to finish.

Running extended ACL
How do we know that extended ACL is running correctly?

You will be able to do the following:


 * Set/Modify ACL
 * Get/Read ACL
 * ACL Mask

Set/Modify ACL
To set ACLs the setfacl command must be invoked. You can read the man page for setfacl for more options

To add username to have read, write and execute on :

To add username to have +write access on :

To add default user access right to read and write on folder:

To add groupname to have read, write and execute on :

To add groupname to have recursive +execute on :

To add default group access right to read and write on folder

Get/Read ACL
To get ACL we need to run the getfacl command. Read getfacl's man page for more options.

To get ACL on :

Remove ACL
Removing ACL is simple.

Remove ACL on /testfiles

Remove default ACL on testfolder:

Which files/folders are under ACL control?
How do you know that your files are under ACL without running getfacl on all files?

The command  will show a   sign if it uses ACL.

Notice the  sign on apache2 and also named.