In this lesson, you will learn how to overcome the limitations of standard POSIX permissions by using Access Control Lists (ACLs) to manage granular multi-user authorization.
The Limitation of Traditional Permissions
As you learned in our previous look at POSIX file access permissions, standard Linux security is limited to three categories: Owner, Group, and Others. While this is efficient for simple systems, it fails in complex scenarios. What happens if you have a shared directory where User A needs read access, User B needs write access, and User C needs execute access, but none of them belong to the same primary group? Traditional permissions force you to create "fake" groups or compromise security by opening permissions to "Others."
Introducing ACLs
Access Control Lists (ACLs) solve this by allowing you to define an arbitrary list of permissions for specific users and groups beyond the traditional owner/group structure. Instead of being restricted to three bits of control, the filesystem uses an extended metadata attribute to store a list of rules that the kernel’s Virtual Filesystem (VFS) layer evaluates during path traversal.
To implement this, you typically use setfacl to add specific rules. For example, if you want to grant alice read access to a file that she doesn't own and isn't in her group, you would run:
setfacl -m u:alice:r file.txt
Once applied, the standard permissions output (which you see when running ls -l) will show a + symbol at the end of the permission string (e.g., -rw-r--r--+). This symbol is your indicator that an ACL is active. You can then view the full list of these rules by running getfacl file.txt.
The kernel evaluates these ACLs before falling back to the standard POSIX permission bits. This allows you to maintain strict security without the administrative overhead of managing dozens of system groups just to accommodate specific user needs.
Key Takeaway: ACLs provide a flexible, fine-grained alternative to the rigid POSIX user/group/others model, allowing you to define custom permissions for individual users and groups on any given file or directory.