In this lesson, you will learn how to systematically upgrade legacy UGO (User, Group, Other) permissions to ACLs without breaking your existing security policies.
The Strategy for Migration
Migrating from traditional UGO permissions to Access Control Lists (ACLs) is not just about adding new rules; it is about preserving the "Principle of Least Privilege" while enabling the granular control that UGO lacks. The transition must ensure that existing access remains identical before you begin adding more complex, named users or groups.
Step 1: Mapping the Baseline
Before enabling ACLs on a directory, capture the current state. The traditional ls -l output provides a perfect mapping. Because POSIX ACLs are designed to be backward compatible, the primary owner, group, and other bits in an ACL are strictly synchronized with the standard UGO bits. When you first apply an ACL to a file, the system automatically translates the existing rwx bits into the ACL format.
Step 2: Applying the Transition
You can transition a directory to use ACLs by using the setfacl command. For example, if you have a shared folder /data/project restricted to a group, you can initialize the ACLs while preserving the current policy:
# Get current permissions and apply them as a base ACL
getfacl -R /data/project > project_perms.bak
setfacl -R -m u::rwx,g::rx,o::r /data/project
By explicitly setting the u:: (owner), g:: (group), and o:: (other) entries, you define the baseline. From this point, you can add specific users without altering the underlying group access:
# Add a specific user to the existing UGO structure
setfacl -m u:alice:rx /data/project
Step 3: Maintaining Constraints
When migrating, the biggest risk is the ACL Mask. The mask acts as a ceiling for all named users and groups. During migration, ensure that your migration script explicitly defines the mask to match the intended group permissions. This prevents the "effective rights" from being accidentally expanded beyond what your original UGO policy intended. By explicitly setting these values, you maintain a predictable security posture during the transition.
Key Takeaway: Migration to ACLs should be an additive process that preserves the original UGO baseline as the foundation, ensuring that existing security constraints remain intact while enabling finer-grained access control.