Permissions & Security (Chmod/Chown/ACLs/SELinux/AppArmor)

Stop relying on the limited standard mode bits for complex directory shares

🧩 The Challenge

You know that feeling when a dev group needs access to a specific folder but the standard user-group-other permissions make you feel like you’re playing a game of Twister just to keep things secure? I’ve spent way too many nights fixing broken access setups because I tried to make standard octal modes work for a dozen different accounts.

💡 The Fix

Switch to POSIX Access Control Lists to handle the granularity without having to add every single person to a massive, messy primary group. It’s cleaner, easier to audit, and doesn’t require you to sacrifice the security of the parent directory.

setfacl -m u:username:rwx /shared/project/data
getfacl /shared/project/data

⚙️ Why It Works

Adding these entries allows you to assign specific read, write, or execute rights to individual users or groups that sit outside the primary owner or group ownership of the file. What’s happening here is the kernel checks these extended attributes after it fails to match the standard owner-group bits, which gives you that surgical precision you’ve been missing.

🚀 Pro-Tip: Run ls -l and look for the plus sign at the end of the mode string to see if a file or directory actually has an ACL active before you start pulling your hair out.

Linux Tips & Tricks | © ngelinux.com | 7/14/2026