Linux ACL and File Attributes: setfacl, getfacl, chattr and lsattr with Examples

By Ravindra Bagale, trainer · LinkedIn · Last updated: 25 October 2026

1. An everyday example: a housing society notice room

Why do we need this?

In a Kothrud society, the office room belongs to the secretary and the committee. The plumber also needs to enter on Tuesdays, but he is not on the committee. Instead of adding him to the committee, the secretary writes his name on a special list at the door: 'Plumber: may enter, may not touch files'. The society rule book is laminated and locked in glass: nobody can change it, not even the secretary, until the glass is unlocked. The visitor register only allows new lines; old lines cannot be erased.

What is it?

Owner and group = secretary and committee. Special list at the door = ACL. 'May enter, may not touch' = r-x for one user. Locked glass = chattr +i (immutable). Visitor register = chattr +a (append-only).

How to do it (step by step)

2. Why ACLs: limits of owner/group/other

Why do we need this?

A file has only one group. If finance needs read and audit needs read-write on the same folder, normal bits cannot do it without messy groups.

What is it?

ACLs add extra entries: user:NAME:rwx and group:NAME:rwx, plus a mask and defaults for new files. They work on ext4, XFS and most modern file systems (mounted with acl, which is the default). A + at the end of ls -l mode means an ACL exists.

How to do it (step by step)

1. Spot an ACL.

ls -ld /srv/reports

Output:

drwxrwx---+ 2 ravi finance 4096 Oct 25 /srv/reports

What it means: The + means there is more than the 9 bits.

2. Is the tool installed?

command -v setfacl getfacl || sudo dnf install -y acl

Output:

/usr/bin/setfacl
/usr/bin/getfacl

What it means: Package name is acl.

3. getfacl: read an ACL

Why do we need this?

Before changing or debugging access you must see every entry, including the mask.

What is it?

getfacl FILE prints owner, group, then user::, user:NAME:, group::, group:NAME:, mask::, other::, and default: lines for folders. '#effective:' shows rights cut by the mask. -R walks a tree. -c hides the header.

How to do it (step by step)

1. Read a folder ACL.

getfacl /srv/reports

Output:

# file: srv/reports
# owner: ravi
# group: finance
user::rwx
user:priya:r-x
group::rwx
group:audit:rwx
mask::rwx
other::---

What it means: priya can read, audit can write.

2. Without header.

getfacl -c /srv/reports/q3.csv

Output:

user::rw-
user:priya:r--
group::r--
mask::r--
other::---

What it means: Short and easy to compare.

3. An effective right cut by the mask.

getfacl -c data.csv | grep effective

Output:

user:sam:rw-		#effective:r--

What it means: sam's w is blocked by the mask.

4. setfacl -m: add or change an entry

Why do we need this?

Give one more person or team access without changing the owner, group or other bits.

What is it?

setfacl -m u:NAME:rwx FILE for a user, -m g:NAME:rx for a group, -m o::- for others. Several at once with commas. -R for a tree (use X to give x only on folders). The mask updates automatically.

How to do it (step by step)

1. Let priya read one file.

setfacl -m u:priya:r q3.csv && getfacl -c q3.csv | grep priya

Output:

user:priya:r--

What it means: No group change needed.

2. Give the audit team write.

setfacl -m g:audit:rw q3.csv && ls -l q3.csv

Output:

-rw-rw----+ 1 ravi finance 9K Oct 25 q3.csv

What it means: The group bits shown are now the mask.

3. Whole tree, folders get x.

setfacl -R -m g:audit:rX /srv/reports

Output:

(no output)

What it means: Files are r, folders r-x.

4. Let nginx pass through a home folder.

setfacl -m u:nginx:x /home/ravi

Output:

(no output)

What it means: Only x: it can reach public_html but cannot list home.

5. Default ACLs: rules for new files

Why do we need this?

Without defaults, new files in a shared folder get no ACL and the extra team loses access.

What is it?

A default ACL on a folder (setfacl -d -m or -m d:...) is copied to new files and sub-folders created inside. It does not change existing files, so pair it with -R -m for those. Only folders can have defaults.

How to do it (step by step)

1. Set a default for audit.

setfacl -d -m g:audit:rX /srv/reports && getfacl -c /srv/reports | grep default

Output:

default:user::rwx
default:group::rwx
default:group:audit:r-x
default:mask::rwx
default:other::---

What it means: Future files get audit access.

2. Check a new file.

touch /srv/reports/q4.csv && getfacl -c /srv/reports/q4.csv | grep audit

Output:

group:audit:r-x		#effective:r--

What it means: Inherited; files do not get x.

3. Existing plus future in two steps.

setfacl -R -m g:audit:rX /srv/reports && setfacl -R -d -m g:audit:rX /srv/reports

Output:

(no output)

What it means: Common pattern for shared folders.

6. The ACL mask

Why do we need this?

People add rw for a user and it still fails. Usually the mask is lower, often after a chmod.

What is it?

mask:: is the maximum right for named users, named groups and the owning group. When a file has an ACL, chmod g=... changes the mask, not the group. setfacl -m m::rwx sets it. setfacl -n stops automatic mask recalculation.

How to do it (step by step)

1. chmod shrinks the mask.

chmod 640 q3.csv && getfacl -c q3.csv | grep -E 'audit|mask'

Output:

group:audit:rw-		#effective:r--
mask::r--

What it means: audit lost write.

2. Restore the mask.

setfacl -m m::rw q3.csv && getfacl -c q3.csv | grep mask

Output:

mask::rw-

What it means: audit can write again.

7. setfacl -x and -b: remove entries

Why do we need this?

When a contractor leaves or a test is over, remove the extra access cleanly.

What is it?

setfacl -x u:NAME FILE removes one user entry, -x g:NAME a group entry. -k removes all default entries. -b removes the whole ACL and leaves only normal bits. -R for trees.

How to do it (step by step)

1. Remove priya.

setfacl -x u:priya q3.csv && getfacl -c q3.csv | grep -c priya

Output:

0

What it means: Her extra access is gone.

2. Remove defaults only.

setfacl -k /srv/reports

Output:

(no output)

What it means: Existing entries stay.

3. Remove all ACLs from a tree.

setfacl -R -b /srv/old && ls -ld /srv/old

Output:

drwxrwx--- 2 ravi finance 4096 /srv/old

What it means: The + is gone.

8. Copy, back up and restore ACLs

Why do we need this?

A plain cp or tar can silently drop ACLs, and after a restore people lose access.

What is it?

cp -a (or --preserve=all) keeps ACLs. rsync -aAX keeps ACLs and xattrs. tar --acls --xattrs on create and extract. getfacl -R > file saves them; setfacl --restore=file puts them back. Copy one file's ACL to another: getfacl a | setfacl --set-file=- b.

How to do it (step by step)

1. Save ACLs of a tree.

getfacl -R /srv/reports > /root/reports.acl && wc -l /root/reports.acl

Output:

58 /root/reports.acl

What it means: A text backup of rights.

2. Restore them.

cd / && setfacl --restore=/root/reports.acl

Output:

(no output)

What it means: Paths are relative to /.

3. rsync with ACLs.

rsync -aAX /srv/reports/ backup:/srv/reports/

Output:

(no output)

What it means: A = ACLs, X = xattrs.

4. tar with ACLs.

tar --acls --xattrs -czf reports.tgz /srv/reports

Output:

(no output)

What it means: Use --acls again when extracting.

9. lsattr: list file attributes

Why do we need this?

A file that even root cannot delete is usually immutable. lsattr shows it.

What is it?

lsattr FILE shows attribute letters: i immutable, a append-only, e extents (normal on ext4), A no atime update, d no dump. lsattr -d FOLDER for the folder itself, -R recursive. Works best on ext4; XFS supports i and a.

How to do it (step by step)

1. Normal file.

lsattr notes.txt

Output:

--------------e------- notes.txt

What it means: Only e: normal ext4 file.

2. Immutable file.

lsattr /etc/resolv.conf

Output:

----i---------e------- /etc/resolv.conf

What it means: Someone locked it.

3. Find all immutable files in /etc.

sudo lsattr -R /etc 2>/dev/null | grep -- '-i-'

Output:

----i---------e------- /etc/resolv.conf

What it means: Useful after 'cannot modify' errors.

10. chattr +i: make a file immutable

Why do we need this?

Stop accidental or automatic changes to a critical file (for example DNS config overwritten by a tool).

What is it?

sudo chattr +i FILE: nobody, including root, can write, delete, rename or link it until chattr -i. Only root (CAP_LINUX_IMMUTABLE) can set or clear it. On a folder, no files can be added or removed inside.

How to do it (step by step)

1. Lock the file.

sudo chattr +i /etc/resolv.conf && lsattr /etc/resolv.conf

Output:

----i---------e------- /etc/resolv.conf

What it means: Locked.

2. Even root is refused.

sudo rm /etc/resolv.conf

Output:

rm: cannot remove '/etc/resolv.conf': Operation not permitted

What it means: Permissions are fine; the attribute blocks it.

3. Unlock to edit.

sudo chattr -i /etc/resolv.conf && sudo vi /etc/resolv.conf

Output:

(editor opens)

What it means: Lock again after editing.

11. chattr +a: append-only

Why do we need this?

Logs should grow but never be edited or truncated, even by an attacker who got a service account.

What is it?

sudo chattr +a FILE: data can only be added at the end (>>). Overwrite (>), truncate and delete fail. Log rotation must clear it first (chattr -a) or use a postrotate step.

How to do it (step by step)

1. Make a log append-only.

sudo chattr +a /var/log/audit-trail.log && lsattr /var/log/audit-trail.log

Output:

-----a--------e------- /var/log/audit-trail.log

What it means: a is set.

2. Appending works.

echo 'login ravi' | sudo tee -a /var/log/audit-trail.log

Output:

login ravi

What it means: New line added.

3. Overwriting fails.

echo x | sudo tee /var/log/audit-trail.log

Output:

tee: /var/log/audit-trail.log: Operation not permitted

What it means: History is safe.

12. Real examples from many industries

Why do we need this?

The same Linux skill shows up in every kind of company. Seeing it in many places helps you remember it.

What is it?

Each row is a made-up team. It shows who uses this and how.

How to do it (step by step)

13. Common errors and how to fix them

Why do we need this?

Everyone hits these errors. Knowing the cause saves hours.

What is it?

Read the exact message first. Then match it to a row below.

How to do it (step by step)

14. Troubleshooting step by step

Why do we need this?

If access is strange, check normal bits, then ACL and mask, then attributes, then SELinux.

What is it?

Go top to bottom. Stop at the first step that shows the problem.

How to do it (step by step)

1. See the bits and the +.

ls -l file

2. Read the full ACL and effective rights.

getfacl file

3. Check the parent folders too.

namei -l /path/to/file

4. Look for i or a attributes.

lsattr file

5. Check the file system supports ACLs.

findmnt -T file

6. Check SELinux last.

ls -Z file

15. Lab 1: Two teams, one folder

Why do we need this?

finance owns /srv/reports; audit gets read-only on existing and future files; one contractor gets temporary read.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Set up groups and folder.

sudo groupadd -f finance; sudo groupadd -f audit; sudo useradd -m -G audit aud1; sudo useradd -m contr1; sudo mkdir -p /srv/reports && sudo chgrp finance /srv/reports && sudo chmod 2770 /srv/reports

Output:

(no output)

2. Give audit read now and later.

sudo setfacl -R -m g:audit:rX /srv/reports && sudo setfacl -d -m g:audit:rX /srv/reports

Output:

(no output)

3. Create a file and test audit.

echo total=100 | sudo tee /srv/reports/q4.txt >/dev/null && sudo -u aud1 cat /srv/reports/q4.txt && sudo -u aud1 sh -c 'echo x >> /srv/reports/q4.txt'

Output:

total=100
sh: /srv/reports/q4.txt: Permission denied

4. Give the contractor read.

sudo setfacl -m u:contr1:rx /srv/reports && sudo setfacl -m u:contr1:r /srv/reports/q4.txt && sudo -u contr1 cat /srv/reports/q4.txt

Output:

total=100

5. Remove the contractor.

sudo setfacl -x u:contr1 /srv/reports /srv/reports/q4.txt && sudo -u contr1 ls /srv/reports

Output:

ls: cannot open directory '/srv/reports': Permission denied

16. Lab 2: Protect files with chattr

Why do we need this?

Make one file immutable and one log append-only, prove it, then undo.

What is it?

A full hands-on lab. Run every step on a test Linux machine (an EC2 instance, a VM, or WSL).

How to do it (step by step)

1. Create test files.

sudo mkdir -p /srv/lab16 && echo v1 | sudo tee /srv/lab16/conf >/dev/null && echo start | sudo tee /srv/lab16/log >/dev/null

Output:

(no output)

2. Set attributes.

sudo chattr +i /srv/lab16/conf && sudo chattr +a /srv/lab16/log && lsattr /srv/lab16

Output:

----i---------e------- /srv/lab16/conf
-----a--------e------- /srv/lab16/log

3. Try to change conf.

echo v2 | sudo tee /srv/lab16/conf

Output:

tee: /srv/lab16/conf: Operation not permitted

4. Append and overwrite log.

echo line2 | sudo tee -a /srv/lab16/log; echo wipe | sudo tee /srv/lab16/log

Output:

line2
tee: /srv/lab16/log: Operation not permitted

5. Undo and clean.

sudo chattr -i /srv/lab16/conf && sudo chattr -a /srv/lab16/log && sudo rm -r /srv/lab16

Output:

(no output)

17. Frequently asked questions

18. Interview questions and answers

Beginner level

Mid level level

Senior level

19. Related chapters

• Linux Ops Refresh for DevOps
• Bash Scripting for Automation
• Linux grep and find Commands with Examples
• How to Set Up Passwordless SSH Between Linux Servers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.