In this lesson, you will learn how the standard Linux UGO (User, Group, Other) permission bits interact with the POSIX Access Control List (ACL) "mask" to determine your final access level.
The Conflict: UGO vs. ACLs
When you apply an ACL to a file, the system faces a challenge: it must remain compatible with legacy tools like ls -l while supporting complex, fine-grained access. To bridge this gap, Linux uses a special entry called the mask.
The mask acts as a "ceiling" for all named users and groups within the ACL. Even if you explicitly grant a user rwx permissions, if the mask is set to r--, that user will be restricted to read-only access.
Resolving the Mask
The most critical interaction occurs between the mask and the traditional group permissions. When you modify a file's group permissions using chmod, the filesystem automatically updates the ACL mask to match those new permissions. This ensures that the traditional chmod command continues to function as an "enforcer" for the broader ACL group settings.
Consider this scenario:
# Check current ACL status
getfacl myfile.txt
# Output:
# user::rw-
# user:bob:rwx # Bob has full access
# group::r-- # The 'group' entry
# mask::r-- # The mask is restrictive!
# other::---
In this case, even though Bob’s individual entry says rwx, the mask::r-- entry forces his effective access to r--. To resolve this, you must adjust the mask:
# Set the mask to allow read and write
setfacl -m m::rw myfile.txt
By adjusting the mask, you raise the ceiling for all named entries, allowing your specific ACL rules to take effect. If you ever find that a user's permissions seem "stuck" or lower than what you configured in the ACL, always check the mask first. The mask essentially filters the ACL entries, ensuring that no individual user or group exceeds the boundary set for the "group" class of the file.
Key Takeaway: The ACL mask acts as an upper-bound filter that overrides individual named entries, and it is automatically kept in sync with the traditional group permission bits via chmod.