How to use the command getfacl (with examples)

The getfacl command is used to retrieve the file access control list (ACL) for a given file or directory. ACLs provide an additional layer of permissions beyond the traditional owner, group, and other permissions. The getfacl command allows users to view these ACLs in a human-readable format.

Use case 1: Display the file access control list

Code:

getfacl path/to/file_or_directory

Motivation: This use case is helpful when you need to understand the specific ACL permissions set on a file or directory. By running this command, you can quickly see who has access and what level of access they have.

Explanation: In the command above, path/to/file_or_directory should be replaced with the actual path to the file or directory you want to inspect. This command will display the ACLs in a human-readable format.

Example output:

# file: path/to/file_or_directory
# owner: user
# group: group
user::rw-
user:john:r--
group::r--
other::---

In this example output, you can see that the owner of the file has read and write permissions (user::rw-), user “john” has read-only permissions (user:john:r--), the group has read-only permissions (group::r--), and everyone else has no access (other::---).

Use case 2: Display the file access control list with numeric user and group IDs

Code:

getfacl -n path/to/file_or_directory

Motivation: Sometimes it can be helpful to view the numeric user and group IDs instead of their names. This use case is useful when you need to parse the output programmatically or if you have a large number of users or groups.

Explanation: The -n option is used to display the numeric IDs instead of the user and group names. By including this option in the command, the output will show the numeric IDs.

Example output:

# file: path/to/file_or_directory
# owner: 1000
# group: 1001
user::rw-
user:1002:r--
group::r--
other::---

In the example output, you can see that the owner of the file has the numeric ID 1000 (owner: 1000), user “john” has the numeric ID 1002 (user:1002:r--), and the group has the numeric ID 1001 (group::r--).

Use case 3: Display the file access control list with tabular output format

Code:

getfacl -t path/to/file_or_directory

Motivation: The tabular output format can provide a more organized and concise view of the ACLs, especially when dealing with complex permission hierarchies or a large number of access entries.

Explanation: The -t option is used to display the ACLs in a tabular output format. This format aligns the different ACL entries, making it easier to read and understand the permissions.

Example output:

path/to/file_or_directory
  # owner: user
  # group: group
  user::rw-
  user:john:r--
  group::r--
  other::---

In the example output, you can see that the file or directory path is displayed at the top, followed by the owner and group information. Each ACL entry is indented and aligned to provide a clear view of the permissions.

Conclusion:

The getfacl command is a powerful tool for viewing file access control lists and understanding the specific permissions set on a file or directory. By using the different options discussed in this article, you can choose the format and level of detail that best suits your needs. Whether you need a human-readable output, numeric IDs, or a tabular format, the getfacl command has you covered.