💡 Permissions & Ownership September 6, 2026 2

Linux Command: setfacl

Set file access control lists for fine-grained permissions

Terminal — Permissions & Ownership

Command

$ setfacl -m u:alice:rw document.txt

setfacl sets Access Control Lists (ACLs) on files and directories. ACLs provide fine-grained permissions beyond the basic owner/group/other model, allowing specific permissions for individual users and groups. setfacl is invaluable when you need to grant access to specific users without changing file ownership or creating new groups. It supports user ACLs, group ACLs, and default ACLs (which are inherited by new files). Default ACLs on directories are particularly useful — they ensure that new files and subdirectories automatically inherit the specified permissions.

Syntax

setfacl [OPTION]... ACL_SPEC FILE...

Key Options

-m — Modify (set) ACL entry
-x — Remove ACL entry
-b — Remove all ACLs
-d — Set default ACL (for directories)
-R — Recursive
--restore — Restore ACLs from backup

Examples

Grant user access

setfacl -m u:alice:rw document.txt

Grant group access

setfacl -m g:contractors:rx /opt/app/

Set default ACL

setfacl -dm u:alice:rwx /shared/project/

Pro Tips

setfacl -dm sets default ACLs on directories. New files automatically inherit these permissions. Essential for shared directories.
The ACL mask limits the maximum permissions for named users and groups. Check with getfacl if permissions seem wrong.
u:user:perms for user ACL. g:group:perms for group ACL. o::perms for others. d: prefix for default ACLs.

Learn more: Full setfacl reference →