In this lesson, you will learn how to grant specific, fine-grained access permissions to individual users or groups without forcing them into a shared primary group or altering the standard UGO (User, Group, Other) ownership.
Beyond UGO Constraints
Standard Linux permissions allow you to define access for an owner, a single group, and everyone else. However, in a professional workflow, you often need to grant a specific developer read access to a file, or a project manager write access to a directory, without making them the owner or changing the file’s group. This is where Named User and Group Entries within POSIX Access Control Lists (ACLs) become essential.
Rather than restructuring your entire group architecture, you can attach an explicit list of access rules directly to the file metadata.
How to Apply Fine-Grained Access
To manage these entries, we use the setfacl command. For example, if you want to grant user alice read and write access to a file called project_data.txt without changing its existing ownership, you would use:
setfacl -m u:alice:rw project_data.txt
In this command, the -m flag tells the system to modify the ACL, u:alice:rw specifies the user and their required permissions, and the final argument is the target file. Similarly, to grant a specific group (e.g., designers) read-only access to that same file, you would use:
setfacl -m g:designers:r project_data.txt
Verification
You can view these entries at any time using the getfacl command. When you run getfacl project_data.txt, you will see your standard ownership metadata followed by the specific named user and group lines. This allows you to audit exactly who has access to the file without needing to parse complex group memberships. By using these named entries, you maintain the "principle of least privilege," ensuring that users only have the access they need, right when they need it, without creating broad, insecure group structures.
Key Takeaway: Named entries provide a precise way to extend access to specific users or groups by appending metadata rules to a file rather than modifying its core UGO ownership.