Permissions & Security (Chmod/Chown/ACLs/SELinux/AppArmor)

Stop playing the guessing game with setfacl masks

🧩 The Challenge

Setting up ACLs on a shared directory sounds great until you realize the mask is silently stripping permissions from your users. You check chmod and everything looks fine, but the application still throws permission denied errors because of that hidden effective mask.

💡 The Fix

Use the -n flag with setfacl to explicitly recalculate the mask based on the permissions you’re actually setting. This stops the kernel from quietly truncating your rights when you add new entries.

setfacl -n -m u:appuser:rwx /shared/data

⚙️ Why It Works

Adding that -n flag tells the system to stop trying to be smart about the mask and just honor the exact permissions you requested. It saves you from that maddening cycle of setting a permission only to watch it get downgraded by the system’s internal logic.

🚀 Pro-Tip: Always run getfacl after you make changes to see exactly what the effective permissions are, not just what you think you set.

Linux Tips & Tricks | © ngelinux.com | 9/28/2026