GETFACL(1) User Commands GETFACL(1)
NAME
getfacl - display discretionary file information
SYNOPSIS
getfacl [
-ad]
file...
DESCRIPTION
For each argument that is a regular file, special file, or named pipe,
the
getfacl utility displays the owner, the group, and the Access Control
List (
ACL). For each directory argument,
getfacl displays the owner, the
group, and the
ACL and/or the default
ACL. Only directories contain
default
ACLs.
The
getfacl utility will fail if executed on a file system that supports
NFSv4
ACLs. See
acl(7) for a description of the difference between the
older POSIX-draft
ACLs and the newer NFSv4
ACLs. The
ls(1) utility, when
used with the
-v or
-V options, will display
ACLs on all types of file
system.
The
getfacl utility may be executed on a file system that does not
support
ACLs. It reports the
ACL based on the base permission bits.
With no options specified,
getfacl displays the filename, the file owner,
the file group owner, and both the
ACL and the default
ACL, if it exists.
OPTIONS
The following options are supported:
-a Displays the filename, the file owner, the file group owner, and
the
ACL of the file.
-d Displays the filename, the file owner, the file group owner, and
the default
ACL of the file, if it exists.
OPERANDS
The following operands are supported:
file The path name of a regular file, special file, or named pipe.
OUTPUT
The format for
ACL output is as follows:
# file: filename
# owner: uid
# group: gid
user::perm
user:uid:perm
group::perm
group:gid:perm
mask:perm
other:perm
default:user::perm
default:user:uid:perm
default:group::perm
default:group:gid:perm
default:mask:perm
default:other:perm
When multiple files are specified on the command line, a blank line
separates the
ACLs for each file.
The
ACL entries are displayed in the order in which they are evaluated
when an access check is performed. The default
ACL entries that may exist
on a directory have no effect on access checks.
The first three lines display the filename, the file owner, and the file
group owner. Notice that when only the
-d option is specified and the
file has no default
ACL, only these three lines are displayed.
The
user entry without a user
ID indicates the permissions that are
granted to the file owner. One or more additional user entries indicate
the permissions that are granted to the specified users.
The
group entry without a group
ID indicates the permissions that are
granted to the file group owner. One or more additional group entries
indicate the permissions that are granted to the specified groups.
The
mask entry indicates the
ACL mask permissions. These are the maximum
permissions allowed to any user entries except the file owner, and to any
group entries, including the file group owner. These permissions restrict
the permissions specified in other entries.
The
other entry indicates the permissions that are granted to others.
The
default entries may exist only for directories. These entries
indicate the default entries that are added to a file created within the
directory.
The
uid is a login name or a user
ID if there is no entry for the
uid in
the system password file,
/etc/passwd. The
gid is a group name or a group
ID if there is no entry for the
gid in the system group file,
/etc/group.
The
perm is a three character string composed of the letters representing
the separate discretionary access rights:
r (read),
w (write),
x (execute/search), or the place holder character
-. The
perm is displayed
in the following order:
rwx. If a permission is not granted by an
ACL entry, the place holder character appears.
If you use the
chmod(1) command to change the file group owner
permissions on a file with
ACL entries, both the file group owner
permissions and the
ACL mask are changed to the new permissions. Be aware
that the new
ACL mask permissions may change the effective permissions
for additional users and groups who have
ACL entries on the file.
In order to indicate that the
ACL mask restricts an
ACL entry,
getfacl displays an additional tab character, pound sign (
#), and the actual
permissions granted, following the entry.
EXAMPLES
Example 1: Displaying file information
Given file
foo, with an
ACL six entries long, the command
host%
getfacl foo would print:
# file: foo
# owner: shea
# group: staff
user::rwx
user:spy:---
user:mookie:r--
group::r--
mask::rw-
other::---
Example 2: Displaying information after chmod command
Continue with the above example, after
chmod 700 foo was issued:
host%
getfacl foo would print:
# file: foo
# owner: shea
# group: staff
user::rwx
user:spy:---
user:mookie:r-- #effective:---
group::---
mask::---
other::---
Example 3: Displaying information when ACL contains default entries
Given directory
doo, with an
ACL containing default entries, the command
host%
getfacl -d doo would print:
# file: doo
# owner: shea
# group: staff
default:user::rwx
default:user:spy:---
default:user:mookie:r--
default:group::r--
default:mask::---
default:other::---
FILES
/etc/passwd system password file
/etc/group group file
ATTRIBUTES
See
attributes(7) for descriptions of the following attributes:
+--------------------+-----------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+--------------------+-----------------+
|Interface Stability | Evolving |
+--------------------+-----------------+
SEE ALSO
chmod(1),
ls(1),
setfacl(1),
acl(2),
aclsort(3SEC),
group(5),
passwd(5),
acl(7),
attributes(7)NOTES
The output from
getfacl is in the correct format for input to the
setfacl -f command. If the output from
getfacl is redirected to a file, the file
may be used as input to
setfacl. In this way, a user may easily assign
one file's
ACL to another file.
February 8, 2020
GETFACL(1)