For each file, getfacl displays the file name, owner, the group,
and the Access Control List (ACL). If a directory has a default ACL,
getfacl also displays the default ACL. Non-directories cannot have default ACLs.
If getfacl is used on a file system that does not support ACLs, getfacl
displays the access permissions defined by the traditional file mode permission
bits.
The output format of getfacl is as follows:
-
1: # file: somedir/
2: # owner: lisa
3: # group: staff
4: user::rwx
5: user:joe:rwx #effective:r-x
6: group::rwx #effective:r-x
7: group:cool:r-x
8: mask:r-x
9: other:r-x
10: default:user::rwx
11: default:user:joe:rwx #effective:r-x
12: default:group::r-x
13: default:mask:r-x
14: default:other:---
Lines 4, 6 and 9 correspond to the user, group and other fields of
the file mode permission bits. These three are called the base ACL
entries. Lines 5 and 7 are named user and named group entries. Line 8 is
the effective rights mask. This entry limits the effective rights granted
to all groups and to named users. (The file owner and others permissions
are not affected by the effective rights mask; all other entries are.)
Lines 10--14 display
the default ACL associated with this directory. Directories may
have a default ACL. Regular files never have a default ACL.
The default behavior for getfacl is to display both the ACL and the
default ACL, and to include an effective rights comment for lines
where the rights of the entry differ from the effective rights.
If output is to a terminal, the effective rights comment is aligned to
column 40. Otherwise, a single tab character separates the ACL entry
and the effective rights comment.
The ACL listings of multiple files are separated by blank lines.
The output of getfacl can also be used as input to setfacl.