Permissions & Security (Chmod/Chown/ACLs/SELinux/AppArmor)

Stop relying on chmod when you need granular file access

🧩 The Challenge

You know the pain when you have a specific web-app user that needs to write to a log directory owned by root, and you end up doing something dangerous like chmod 777. I’ve wasted hours cleaning up after people who took the lazy path instead of doing it right.

💡 The Fix

Use POSIX Access Control Lists to grant specific permissions to a user or group without messing with standard ownership or making the directory world-writable. It is the surgical tool you need when standard permission bits just aren’t flexible enough.

setfacl -m u:www-data:rwx /var/log/my-app/

⚙️ Why It Works

Adding an ACL entry modifies the filesystem metadata to track extra permissions for specific UIDs, which the kernel respects just like normal ownership bits. It keeps the directory secure while letting your service process do its job.

🚀 Pro-Tip: Use getfacl to verify the rules before you spend time wondering why your application still gets permission denied errors.

Linux Tips & Tricks | © ngelinux.com | 11/8/2026