Grant a Named User an ACL Entry

Now let's make the teacher's exception real: allow the named assistant to read one report. setfacl modifies an ACL, while getfacl lets you inspect what was configured. This is a focused alternative to giving every unrelated user access through the others triplet.

Be specific about both the requested entry and its effective result. The mask can limit the named entry, and the tool may update that mask during a change. We will inspect immediately instead of assuming the command text alone tells the whole access story.

Prepare the example

Use the practice VM with ACL support, installed ACL tools and the existing school-assistant account. The first command prepares marks.txt owned by you. You need the appropriate authority to edit its ACL. The filename and account name in the example must refer to these actual practice resources.

Bash · Linux terminal

touch marks.txt
setfacl -m u:school-assistant:r marks.txt
getfacl marks.txt

Expected behavior; machine-dependent details

A named user entry appears; the mask and effective permissions must be inspected.

setfacl -m u:school-assistant:r marks.txt uses -m to modify an entry. The u identifies a user entry, the middle part names the assistant, and r requests read. The colons separate those fields; they are not directory separators.

getfacl marks.txt then shows the resulting entry and any mask. Read effective-permission annotations if present. Removing the assistant's named entry later is not necessarily complete denial, because applicable group or others rules may still grant access. A default ACL on a directory is also a different target and operation from the access ACL we changed on this report.

setfacl edits Access Control Lists on files and directories. It is especially useful when one additional user needs access but changing the owning group would be too broad.

Step 1: Create a Directory and File

Let’s begin by creating a sample directory and a file.

mkdir acl_demo
cd acl_demo
touch report.txt

Step 2: View Default Permissions

ls -l report.txt

-rw-r--r-- 1 user user 0 Jul  2 10:00 report.txt

Right now, only the file owner (you) can write to this file. Others can only read it.

Step 3: Grant Write Permission to Another User Using setfacl

Suppose we want to give write permission to another user, say alice.

setfacl -m u:alice:w report.txt

Here’s what this means:

• -m means modify ACL
• u:alice:w means give user 'alice' write access

Step 4: Check the Updated ACL

getfacl report.txt

# file: report.txt
# owner: user
# group: user
user::rw-
user:alice:-w-
group::r--
mask::rw-
other::r--

Now you can see that alice has write permission!

Step 5: Give Multiple Permissions (Read + Write)

setfacl -m u:alice:rw report.txt

Check again:

getfacl report.txt

user:alice:rw-

Step 6: Set Default ACLs on a Directory

A default ACL supplies permissions for new children, subject to the requested creation mode. The next command is a separate directory example: run it from the parent of acl_demo, or replace its operand with . if you are still inside acl_demo from Step 1. It does not rewrite existing children.

setfacl -d -m u:alice:rw acl_demo

The -d flag sets default ACLs.

Step 7: Remove ACL for a User

setfacl -x u:alice report.txt

This removes Alice’s named entry. It does not guarantee that Alice loses all access: ordinary group or others permissions may still allow it.

Step 8: Remove All ACLs

setfacl -b report.txt

This removes extended access ACL entries while retaining the base owner, group and others entries. It does not mean that permissions are reset to a universal default.

Bonus: Check if ACLs are Enabled

The following is an ext-family filesystem metadata example, not a universal ACL capability test. It requires the appropriate tool, device and privileges; do not guess a device path. To verify the practical behavior, set and inspect an ACL on a disposable file on the actual filesystem.

tune2fs -l /dev/sdX | grep "Default mount options"

Replace /dev/sdX with your actual disk device.

Grant targeted access with setfacl

Now you know how to use setfacl to grant specific permissions to different users in Linux.

This is especially useful in shared environments and multi-user systems.

Practice with sample files and explore combining ACLs with traditional permissions for powerful control.

Your task: Why inspect the ACL mask after adding a user entry?

Use the practice VM with ACL support, installed ACL tools and the existing school-assistant account. The first command prepares marks.txt owned by you. You need the appropriate authority to edit its ACL. The filename and account name in the example must refer to these actual practice resources.

Bash · complete example for this question

touch marks.txt
setfacl -m u:school-assistant:r marks.txt
getfacl marks.txt

Expected behavior; machine-dependent details

A named user entry appears; the mask and effective permissions must be inspected.

Worked answer

It can limit the entry's effective permission.

Inspect the mask because it can limit the named entry's effective rights. Do not interpret a mask as a decorative label. Verify requested and effective access, then test with the relevant practice identity when the actual collaboration behavior matters.

Grant a narrow named entry and inspect the result on the actual file. Keep masks, base permissions and possible remaining access paths in view. Removing an ACL exception, clearing extended entries and changing a directory's default policy each answer a different request.