Consider a shared directory on a project server with this requirement:

With traditional chmod, bob and charlie would need to be in the same group and get the same permissions. ACLs let you give each user exactly the right access.

An ACL is a list of entries. Each entry has exactly three parts:

Present in every ACL exactly once. Defines what the file owner (the user who created or owns the file) can do. Directly maps to the traditional owner permission bits (the leftmost rwx in ls -l).

# In text form — no qualifier needed, just a dash
ACL_USER_OBJ   -   rwx

# In getfacl short format:
user::rwx

Can have zero or more of these, but at most one per user. Each entry gives specific permissions to one particular user, identified by their UID. This is the power of ACLs — giving custom rights to any user.

# User with UID 1007 gets read-only
ACL_USER   1007   r--

# User 'bob' gets read + execute
user:bob:r-x

# User 'alice' gets full access
user:alice:rwx

Present in every ACL exactly once. Defines permissions for the file’s owning group. When no ACL_MASK entry exists, this maps to the traditional group bits. When ACL_MASK is present, the mask value shows in group bits instead.

ACL_GROUP_OBJ   -   r-x

# In getfacl format:
group::r-x

Can have zero or more of these, but at most one per group. Gives permissions to a specific group by GID. Very useful for team-based access control.

# Group 'developers' gets read+write
ACL_GROUP   developers   rw-

# Group ID 103 gets write-only
ACL_GROUP   103   -w-

# In getfacl format:
group:teach:--x

At most one per ACL. Acts as an upper limit on permissions that can be granted by ACL_USER, ACL_GROUP_OBJ, and ACL_GROUP entries. Mandatory if any ACL_USER or ACL_GROUP entries exist. This entry is the key to compatibility with traditional chmod(). Covered in depth in Part 4.

# Even if a user entry says rwx, effective = rwx AND mask
# If mask is rw-, user gets rw- at most
ACL_MASK   -   rw-

# In getfacl format:
mask::rw-

Present in every ACL exactly once. Applies to any process that does not match any other ACL entry. Maps directly to the traditional “other” permission bits.

ACL_OTHER   -   r--

# In getfacl format:
other::r--

Here is what a complete extended ACL looks like for a file:

ACLs need kernel + filesystem support. Here is how to enable them:

# Step 1: Mount filesystem with ACL support
sudo mount -o remount,acl /dev/sda1 /home

# Or add to /etc/fstab permanently:
# /dev/sda1  /home  ext4  defaults,acl  0 2

# Step 2: Verify ACL support is enabled
tune2fs -l /dev/sda1 | grep "Default mount options"
# Should show: acl

# Step 3: Check kernel config (ACL must be built in or as module)
grep -i acl /boot/config-$(uname -r)
# CONFIG_EXT4_FS_POSIX_ACL=y

# Create a fresh file
touch project.c

# Check permissions the traditional way
ls -l project.c
# -rw-r--r-- 1 ravi users 0 Jan 1 10:00 project.c
# No '+' sign = minimal ACL only

# View ACL using getfacl
getfacl project.c
# file: project.c
# owner: ravi
# group: users
user::rw-     <-- ACL_USER_OBJ (owner)
group::r--    <-- ACL_GROUP_OBJ
other::r--    <-- ACL_OTHER

# Give bob read-only access
setfacl -m u:bob:r-- project.c

# Give devteam group read+write access
setfacl -m g:devteam:rw- project.c

# View the new ACL
getfacl project.c
# file: project.c
# owner: ravi
# group: users
user::rw-
user:bob:r--        <-- new ACL_USER entry
group::r--
group:devteam:rw-   <-- new ACL_GROUP entry
mask::rw-           <-- setfacl auto-created this!
other::r--

# Notice: ls -l now shows a '+' sign
ls -l project.c
# -rw-rw-r--+ 1 ravi users 0 Jan 1 10:00 project.c

#include <stdio.h>
#include <stdlib.h>
#include <sys/acl.h>
#include <acl/libacl.h>

/* Returns human-readable tag type name */
const char *tag_to_str(acl_tag_t tag) {
    switch (tag) {
        case ACL_USER_OBJ:  return "ACL_USER_OBJ ";
        case ACL_USER:      return "ACL_USER     ";
        case ACL_GROUP_OBJ: return "ACL_GROUP_OBJ";
        case ACL_GROUP:     return "ACL_GROUP    ";
        case ACL_MASK:      return "ACL_MASK     ";
        case ACL_OTHER:     return "ACL_OTHER    ";
        default:            return "UNKNOWN      ";
    }
}

int main(int argc, char *argv[]) {
    if (argc != 2) {
        fprintf(stderr, "Usage: %s filename\n", argv[0]);
        return 1;
    }

    /* Load ACL from disk into memory */
    acl_t acl = acl_get_file(argv[1], ACL_TYPE_ACCESS);
    if (!acl) { perror("acl_get_file"); return 1; }

    printf("File: %s\n", argv[1]);
    printf("%-14s %-10s %s\n", "Tag Type", "Qualifier", "Permissions");
    printf("%-14s %-10s %s\n", "--------", "---------", "-----------");

    acl_entry_t entry;
    acl_tag_t   tag;
    int id = ACL_FIRST_ENTRY;

    /* Loop through all ACL entries */
    while (acl_get_entry(acl, id, &entry) == 1) {
        id = ACL_NEXT_ENTRY;

        acl_get_tag_type(entry, &tag);
        printf("%-14s ", tag_to_str(tag));

        /* Print qualifier (UID/GID) if applicable */
        if (tag == ACL_USER) {
            uid_t *uid = acl_get_qualifier(entry);
            printf("UID=%-6d ", (int)*uid);
            acl_free(uid);
        } else if (tag == ACL_GROUP) {
            gid_t *gid = acl_get_qualifier(entry);
            printf("GID=%-6d ", (int)*gid);
            acl_free(gid);
        } else {
            printf("%-10s ", "-");
        }

        /* Print permissions */
        acl_permset_t perms;
        acl_get_permset(entry, &perms);
        printf("%c%c%c\n",
            acl_get_perm(perms, ACL_READ)    ? 'r' : '-',
            acl_get_perm(perms, ACL_WRITE)   ? 'w' : '-',
            acl_get_perm(perms, ACL_EXECUTE) ? 'x' : '-'
        );
    }

    acl_free(acl);
    return 0;
}

/* Compile: gcc -o read_acl read_acl.c -lacl
   Usage:   ./read_acl project.c */

#include <stdio.h>
#include <sys/stat.h>
#include <sys/acl.h>
#include <acl/libacl.h>

int main(int argc, char *argv[]) {
    if (argc != 2) {
        fprintf(stderr, "Usage: %s filename\n", argv[0]);
        return 1;
    }

    acl_t acl = acl_get_file(argv[1], ACL_TYPE_ACCESS);
    if (!acl) { perror("acl_get_file"); return 1; }

    mode_t mode;
    /* acl_equiv_mode returns 0 if ACL == traditional perms (minimal) */
    int is_minimal = (acl_equiv_mode(acl, &mode) == 0);

    printf("File:    %s\n", argv[1]);
    printf("ACL type: %s\n", is_minimal ? "MINIMAL (3 entries)" : "EXTENDED");

    if (is_minimal) {
        printf("Equiv perms: %04o\n", (unsigned)mode & 0777);
        printf("No extended attribute needed on disk.\n");
    } else {
        printf("Stored in: system.posix_acl_access extended attribute\n");
        printf("ls -l will show a '+' after permissions.\n");
    }

    acl_free(acl);
    return 0;
}
/* Compile: gcc -o acl_type acl_type.c -lacl */