getfaclShow a file's ACL
getfacl prints the full permission picture of a file: owner, group, special flags, the base entries, every named user and group entry, the mask and any default ACL, with #effective notes where the mask cuts rights. Its output can be saved and fed back to setfacl to restore permissions.
getfacl [-R] [-p] [-c] [-e] [-a | -d] [-t] FILE...ls -l shows a + on /srv/app/logs and you want to see who else has access.
getfaclReads and prints POSIX ACLs (package acl).
getfacl calls getxattr for system.posix_acl_access (and system.posix_acl_default on directories) through libacl. If a file has no extended ACL, it builds the three base entries from the ordinary mode bits, so it works on any file. It prints a header (# file, # owner, # group, and # flags when setuid, setgid or sticky are set, as a three-character s/s/t string), then the entries in canonical order: user::, user:NAME:, group::, group:NAME:, mask::, other::, followed by default: entries. For each named user and group entry it compares the permissions with the mask and appends #effective: when the mask removes bits. Names are resolved through NSS; with -n you get numeric IDs. By default it strips the leading / from paths and warns on stderr, so a dump made with -R is meant to be restored with cd / first.
-RRecurse into directories-pDon't strip the leading / (absolute paths)-c / --omit-headerDon't print the # file/owner/group header-ePrint #effective for every entry, even when unchanged-a / -dOnly the access ACL / only the default ACL-tTabular format (base entries in capitals)-nNumeric UIDs and GIDs-sSkip files that only have the base entriesJudging access from ls -l alone on a file with a +ls shows the mask in the group slot and nothing about named entries.
getfacl FILE (and read any #effective notes)Restoring a getfacl -R dump from the wrong directoryWithout -p the paths are stored relative (srv/app/...), so setfacl --restore can't find them.
cd / && setfacl --restore=FILE, or dump with getfacl -R -pReading the entry text (rw-) as the actual rightThe mask can remove bits; the real right is the #effective value.
Use getfacl -e to print effective rights for every entryTry these on a Linux machine of your own. Each task has a hint and a solution.
Show the ACL of your home directory, then of /tmp. What does the # flags line for /tmp mean?
Give www-data read on a file in ~/data, then print the ACL without the header.
Save the ACLs of ~/data recursively with absolute paths, remove all ACLs, then restore them.
getfaclShow a file's ACL
getfacl prints the full permission picture of a file: owner, group, special flags, the base entries, every named user and group entry, the mask and any default ACL, with #effective notes where the mask cuts rights. Its output can be saved and fed back to setfacl to restore permissions.
getfacl [-R] [-p] [-c] [-e] [-a | -d] [-t] FILE...ls -l shows a + on /srv/app/logs and you want to see who else has access.
getfaclReads and prints POSIX ACLs (package acl).
getfacl calls getxattr for system.posix_acl_access (and system.posix_acl_default on directories) through libacl. If a file has no extended ACL, it builds the three base entries from the ordinary mode bits, so it works on any file. It prints a header (# file, # owner, # group, and # flags when setuid, setgid or sticky are set, as a three-character s/s/t string), then the entries in canonical order: user::, user:NAME:, group::, group:NAME:, mask::, other::, followed by default: entries. For each named user and group entry it compares the permissions with the mask and appends #effective: when the mask removes bits. Names are resolved through NSS; with -n you get numeric IDs. By default it strips the leading / from paths and warns on stderr, so a dump made with -R is meant to be restored with cd / first.
-RRecurse into directories-pDon't strip the leading / (absolute paths)-c / --omit-headerDon't print the # file/owner/group header-ePrint #effective for every entry, even when unchanged-a / -dOnly the access ACL / only the default ACL-tTabular format (base entries in capitals)-nNumeric UIDs and GIDs-sSkip files that only have the base entriesJudging access from ls -l alone on a file with a +ls shows the mask in the group slot and nothing about named entries.
getfacl FILE (and read any #effective notes)Restoring a getfacl -R dump from the wrong directoryWithout -p the paths are stored relative (srv/app/...), so setfacl --restore can't find them.
cd / && setfacl --restore=FILE, or dump with getfacl -R -pReading the entry text (rw-) as the actual rightThe mask can remove bits; the real right is the #effective value.
Use getfacl -e to print effective rights for every entryTry these on a Linux machine of your own. Each task has a hint and a solution.
Show the ACL of your home directory, then of /tmp. What does the # flags line for /tmp mean?
Give www-data read on a file in ~/data, then print the ACL without the header.
Save the ACLs of ~/data recursively with absolute paths, remove all ACLs, then restore them.