Understanding chmod, chown, setfacl, and getfacl in Linux

Basic Linux Permission Model

Before we dive into the commands, understand the Linux permission structure:

ls -l
-rw-r--r-- 1 user group 1234 Jul  6 12:00 example.txt

• -rw-r--r-- – permission string

  • r – read, w – write, x – execute

  • First set (user), second (group), third (others)

• user – owner of the file

• group – group owner of the file

chmod – Change File Permissions

Syntax:

chmod [options] mode file

Types of Modes:

1. Symbolic Mode: u, g, o, a (user, group, others, all)

2. Octal Mode: Numeric representation of permissions

Octal Reference:

• 4 – read

• 2 – write

• 1 – execute

Examples:

1. Give full permissions to user, read-only to group and others:

chmod 744 file.txt
# -rwxr--r--

2. Add execute permission to user:

chmod u+x script.sh

3. Remove write permission from others:

chmod o-w file.txt

chown – Change File Owner or Group

Syntax:

chown [OPTIONS] [OWNER][:GROUP] FILE

Examples:

1. Change owner:

chown rohit file.txt

2. Change owner and group:

chown rohit:devops file.txt

3. Recursively change ownership:

chown -R rohit:devops /var/www/html

setfacl – Set Access Control Lists (ACLs)

ACLs allow you to grant permissions to multiple users and groups beyond the basic user/group/others model.

Syntax:

setfacl [options] file

Common Options:

• -m – modify ACL

• -x – remove ACL

• -b – remove all ACLs

Examples:

1. Give read access to user alice:

setfacl -m u:alice:r-- file.txt

2. Give read and write to group editors:

setfacl -m g:editors:rw- file.txt

3. Remove ACL for user alice:

setfacl -x u:alice file.txt

4. Set default ACLs (for directories):

setfacl -d -m u:rohit:rwx my_folder

getfacl – View ACLs

Syntax:

getfacl file

Example:

getfacl file.txt

Output:

# file: file.txt
# owner: rohit
# group: devops
user::rw-
user:alice:r--
group::r--
mask::r--
other::r--

• mask – maximum permissions allowed via ACLs (important when combining multiple ACL entries)

Real-Life Scenario Example

Goal:

You have a file project.txt owned by rohit, and you want:

• bob to have read-only access

• Group designers to have read and write

• Prevent all other users from accessing it

Step-by-step:

touch project.txt
chown rohit:rohit project.txt
chmod 600 project.txt                          # Only owner can read/write

setfacl -m u:bob:r-- project.txt               # Allow bob to read
setfacl -m g:designers:rw- project.txt         # Allow group designers to read/write

getfacl project.txt

Resetting Permissions

To remove all ACLs and go back to regular permissions:

setfacl -b file.txt

Summary Table

Pro Tips

• ACLs can override traditional Unix permissions.

• Always check getfacl after applying ACLs to verify changes.

• Use umask or default ACLs to enforce permission policies automatically.