getfacl Command

Display Access Control Lists (ACLs) for files and directories to show detailed permission information beyond standard Unix permissions.

Syntax

getfacl [options] file... getfacl [options] directory... getfacl -d [options] directory... getfacl -R [options] directory...

The getfacl command displays Access Control Lists (ACLs) for files and directories, showing detailed permission information beyond standard Unix permissions.

Basic Usage

View ACLs for files

# Display ACLs for a specific file getfacl filename.txt getfacl /path/to/file # Display ACLs for multiple files getfacl file1.txt file2.txt file3.txt # Display ACLs for all text files getfacl *.txt

View Access Control Lists for individual files or groups of files

View ACLs for directories

# Display ACLs for a directory getfacl /home/user/ getfacl /var/log/ # Display default ACLs for a directory getfacl -d /home/user/ # Display both file and default ACLs getfacl -a /home/user/

Examine ACLs for directories and their default permission settings

Recursive ACL viewing

# Display ACLs recursively for a directory getfacl -R /home/user/ # Display default ACLs recursively getfacl -d -R /home/user/ # Display all ACLs recursively getfacl -a -R /home/user/

Recursively examine ACLs throughout directory trees

Common Options

ACL type options

# Display access ACLs (default) getfacl filename # Display default ACLs only getfacl -d directory # Display all ACLs getfacl -a directory # Display access ACLs only getfacl -A directory

Choose which types of ACLs to display

Output format options

# Skip base entries getfacl -s filename # Skip base entries and comments getfacl -s -c filename # Skip base entries, comments, and header getfacl -s -c -h filename # Show numeric user/group IDs getfacl -n filename

Control the format and content of ACL output

Recursive and traversal options

# Recursive traversal getfacl -R directory # Follow symbolic links getfacl -L directory # Don't follow symbolic links getfacl -P directory # Skip errors getfacl -s directory

Control how getfacl traverses directories and handles errors

Practical Examples

System administration tasks

# Check ACLs for important system files getfacl /etc/passwd getfacl /etc/shadow getfacl /etc/sudoers # Check ACLs for user directories getfacl /home/user1/ getfacl /home/user2/ # Check ACLs for shared directories getfacl /shared/ getfacl /var/www/

Common administrative tasks using getfacl

Permission troubleshooting

# Why can't user access a file? getfacl /path/to/file getfacl -d /path/to/directory # Check ACL inheritance getfacl -a -R /path/to/directory # Compare ACLs between files getfacl file1.txt > acl1.txt getfacl file2.txt > acl2.txt diff acl1.txt acl2.txt

Use getfacl to diagnose permission and access issues

ACL documentation and backup

# Document current ACLs getfacl -R /important/directory/ > acls_backup.txt # Check ACLs before changes getfacl file.txt > before.txt # Make changes... getfacl file.txt > after.txt diff before.txt after.txt # Export ACLs for restoration getfacl -R /home/user/ > user_acls.txt

Document and backup ACLs for system maintenance

Best Practices

getfacl Best Practices
  • Use -d option to check default ACLs for directories
  • Use -R option for comprehensive directory analysis
  • Combine with setfacl for ACL management
  • Document ACLs before making changes
  • Use -s option to focus on ACL entries
  • Check both access and default ACLs
Common Pitfalls
  • ACL support - Filesystem must support ACLs
  • Permission confusion - ACLs can override standard permissions
  • Inheritance complexity - Default ACLs affect new files
  • Performance impact - Recursive operations can be slow
  • Backup requirements - ACLs may not be preserved in all backups

See also