Access Control List (ACL) In Linux

Access Control Lists (ACL) in Linux provide a powerful way to manage permissions beyond the traditional user, group, and others model.

Are you still sticked to the old and traditional method of assigning permissions to the linux files and directory? You can set the file permissions or directory permissions directly for user(owner), groups and others but if we want to add the permissions for the specific/unique users that are not present in the group then this can be done with the help of file access control list.

File Access Control Lists (FACLs) in Linux provide a more flexible permission system than the traditional UNIX file permission model. They allow you to define permissions for multiple users and groups on a per-file or per-directory basis, extending beyond the standard owner-group-other permission scheme.

To get an overview, see the Linux File permissions unveiled.

How to install ACL in Linux:

If you want to allow permissions to the specific users or group then this can be done via access control list. This package is available in linux by default and can be installed manually via below command.

For Debian based system.

apt install facl -y

for CentOS based system you can use below command.

yum install facl -y

How to check for Access control List (ACL):

Once installed, you can see the ACL assigned to specific file and directory with the help of getfacl command.

getfacl file

You might get the following output when you first time use this command.

# file: test/                                                         
# owner: root                                                                 
# group: root                                                                 
user::rwx                                                                     
group::r-x                                                                    
other::r-x

How to modify Access Control List (ACL):

If you want to assign the permissions to the unique users or groups then this can be done with the help of setfacl command. To assign the ACL to the file, you must be a super user or the file owner. -m flag is for modification.

setfacl -m u:user1:rwx file

setfacl --modify u:user1:rwx file

To set recursive permissions for a directory, use the -R option:

setfacl  -R  -m u:user1:rwx /path/to/directory/

setfacl -R  -m u:user2:rw /path/to/directory/

How to remove Access Control List (ACL):

To remove ACL from a file or directory, use the setfacl command with the -x option:

setfacl -x u:user1 /path/to/file

To remove the ACL from directory recursively

setfacl -R -x u:user1 /path/to/directory/

Removing All Entries from Access Control List (ACL):

To remove all entries for a file, use the setfacl command with -b option

setfacl -b /path/to/your/file

To remove all ACL entries on a directory and its contents:

setfacl -b -R /path/to/your/directory

Best Practices and considerations

For critical files and directories it is recommended to maintain the detailed record of ACL configurations.
To ensure the security compliance, review and Audit ACL periodically.
Promote responsible usage to reduce the security risk and avoid the rules duplication.

By understanding and implementing these ACL-related concepts and practices, Linux administrators can optimize access control, enhance security, and ensure a well-managed and secure computing environment.

Thank you for reading the blog. Hopefully after reading this guide you will be able to understand how facl works in linux and how to give a specific user or group specific permissions. In order to reads more linux related blogs please do check our site simplealltech.com.