In this lesson, you will learn how the ACL mask entry acts as a "ceiling" that limits the maximum permissions any named user or group can exercise, regardless of their specific access rules.
Understanding the Mask
When you use POSIX Access Control Lists (ACLs), you aren't just limited to the owner, the group, and others. You can add specific users or additional groups to a file's security policy. However, Linux implements a safety mechanism called the mask. Think of the mask as a "permission filter." No matter what permissions you explicitly grant to a specific user or group, the mask dictates the absolute highest level of access they are allowed to have.
Calculating Effective Rights
To determine the "Effective Rights," the system performs a logical AND operation between the specific entry (the user or group) and the mask.
If the mask is r-- (read-only), and you grant a user rw- (read-write), the effective rights become r--. The user is blocked from writing because the mask restricts the "write" bit.
Consider this getfacl output for a file named report.txt:
user::rw-
user:jdoe:rwx # Intent is read-write-execute
group::r--
mask::r-- # The filter
other::r--
Even though jdoe was granted rwx, the Effective Rights are calculated as:
rwx (jdoe) AND r-- (mask) = r--
Because the mask is set to read-only, jdoe can only read the file. Any attempts to write or execute will be denied by the kernel, even though the specific entry for jdoe looks like it has full access.
Why does this exist?
This design allows system administrators to temporarily "throttle" all additional ACL entries simultaneously without having to edit every single user or group entry individually. If a security concern arises, you can tighten the mask to restrict everyone instantly, and then loosen it back to your preferred policy once the situation is resolved.
Key Takeaway: The mask entry serves as an upper-bound filter; if a bit is not set in the mask, it cannot be exercised by any named user or group, regardless of their individual permission settings.