>

Grant Per-User File Access with setfacl and getfacl

Use POSIX ACLs to grant an individual user read/execute rights on a file without touching its owner, group, or the 755 bits everyone else relies on.

LinuxpermissionssetfaclaclMedium risk
Run setfacl -m u:deploy:rx /var/www/app to give user 'deploy' read+execute, and getfacl /var/www/app to view the resulting ACL.

01Command

Command
$ setfacl -m u:deploy:rx /var/www/app
getfacl /var/www/app

02What it does

Access control lists extend the classic owner/group/other model: setfacl -m adds an entry granting a named user (u:name) or group (g:name) specific permissions, while getfacl prints the full effective ACL. This solves the recurring 'user X needs access but changing the group breaks something' problem cleanly. After modification the classic permission bits gain a trailing + in ls -l, signalling that extended entries exist.

03Risk

RiskMedium risk
Requirementsacl package (sudo apt install acl); filesystem must be mounted with the acl option
!Warning: ACLs are silently ignored on filesystems mounted without the acl option, and rsync/tar need flags (--acls) to preserve them — verify with getfacl after any copy.

04Undo

Undo
$ setfacl -x u:deploy /var/www/app

05Sources

  • setfacl(1) — Linux manual page
    man7.org · technical · 2026-09-17
    Evidence: setfacl man page: '-m, --modify=acl Modify the ACL of the file(s)' with u:uid:perms entry syntax.
  • Debian Wiki: ACL
    Debian · vendor-doc · 2026-09-17
    Evidence: Documents installing the acl package and the default-ACL feature for new files in a directory.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Make a File Immutable with chattr +i
Linuximmutablepermissionschattr

chattr sets filesystem attributes that override normal permissions — +i makes a file unmodifiable and undeletable, even by root.

Medium risk ✓ 2026-09-17