filsystemACLs

A filesystem ACL (access control list) is a metadata mechanism attached to a file or directory that specifies which principals can access it and what operations they are allowed to perform. It complements the traditional owner, group, and other permission bits by enabling finer-grained control. In many POSIX-compliant systems, ACLs are optional extensions that work alongside the basic read, write, and execute permissions.

An ACL consists of multiple entries that define rights for users and groups, plus a mask and an optional everyone entry. Each entry grants specific rights such as read, write, or execute. The mask entry sets the maximum rights available to named users and groups. In POSIX ACLs, denied access is typically expressed by omitting rights rather than listing explicit deny entries. Default ACLs can be attached to directories so that new files created within inherit those rights.

Platform differences exist in how ACLs are implemented and used. Linux and other POSIX systems (such as ext4, XFS, and ZFS) support POSIX ACLs and provide tools like getfacl and setfacl to view and modify them. Windows NTFS uses a different but related model based on access control lists (DACLs) as part of security descriptors. macOS also supports POSIX ACLs, while NFSv4 defines its own ACL model with access control entries. Cross-platform interoperability often relies on translation or compatibility layers, such as Samba shares.

Management and best practices include using ACLs to grant the minimum necessary rights, documenting the rationale, and using default ACLs to propagate permissions in directories. ACLs can add complexity and potential inconsistencies, so regular auditing and testing with representative users are advisable.