In this lesson, you will learn how to detect the presence of Access Control Lists (ACLs) on your filesystem using standard tools when traditional UGO permissions appear incomplete.
The Limitation of ls -l
When you run ls -l in a directory, the output displays the standard UGO (User, Group, Others) permission string (e.g., -rw-r--r--). However, this display is deceptive. It only provides a summary of the owner, group, and world permissions. If you have applied specific ACLs—such as granting read access to a specific named user or a secondary group—the standard ls output will not show these extra entries.
If you see a + sign at the end of the mode string, it is your signal that something is hidden.
Spotting the Plus Sign
Consider the following output from ls -l:
-rw-rw-r--+ 1 admin staff 4096 May 10 10:00 project_data.txt
That + symbol is the "smoking gun." It indicates that the file or directory has an extended ACL attached to it that modifies the traditional UGO permissions. Even if the UGO bits suggest a user shouldn't have access, that + sign tells you that an additional rule is likely overriding or supplementing the standard model.
Using getfacl to Reveal the Truth
To see the "hidden" rules that the + symbol is protecting, you use the getfacl command. This tool strips away the mystery by listing every access entry associated with the file:
$ getfacl project_data.txt
# file: project_data.txt
user::rw-
user:developer:r-- <-- This is the hidden rule
group::rw-
mask::rw-
other::r--
By running getfacl, you can identify exactly which specific users or groups have been granted access beyond the basic UGO settings. If you ever encounter a file where your permissions seem "off" compared to what ls -l suggests, always check for the + sign and use getfacl to audit the extended metadata.
Key Takeaway: The + sign in the ls -l output is a critical indicator that an ACL exists, necessitating the use of getfacl to audit the true access configuration.