setfacl
Permissions
Usage
sudo setfacl -m u:[user]:rwx [path]Grants rights to one extra user or group without changing the owner; once an ACL exists ls shows a + after the mode, and the mask entry can quietly cap what you granted.
Common flags
| Flag | Meaning |
|---|---|
| -m | Add or change an entry, as in -m u:jenkins:rx |
| -x | Remove one entry |
| -b | Remove every ACL entry |
| -R | Apply to a whole tree |
| -d | Work on the default ACL, which new files inherit |
| --set | Replace the entire ACL in one go |
Examples
setfacl -m u:jenkins:rx /srv/appGives one extra user read and execute.
setfacl -R -d -m g:devs:rwX /srv/sharedNew files inherit rights for the devs group.
setfacl -b report.pdfStrips the ACL back to plain permission bits.
Numeric and symbolic modes name the same thing: 755 and u=rwx,go=rx are the same permission.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does setfacl do?
Grants rights to one extra user or group without changing the owner; once an ACL exists ls shows a + after the mode, and the mask entry can quietly cap what you granted.
Q. How do I type it?
sudo setfacl -m u:[user]:rwx [path] — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
6 are listed here; the full set is in man setfacl. This command sits under Permissions.
Related commands
man page: man setfacl