ACL Permission Calculator
Calculate effective access permissions when POSIX ACLs override standard file mode bits.
About ACL Permission Calculator
POSIX ACLs let administrators grant specific permissions to individual users or groups beyond the standard owner/group/others model, but every named ACL entry (and the owning group entry, when ACLs are present) is capped by the ACL mask — the effective permission actually granted is the bitwise AND of the entry's requested permissions and the mask. This means raising a named user's ACL entry to rwx has no effect if the mask only permits r-x; the mask must be widened first (or setfacl -m automatically recalculates it, unless the -n flag is used to suppress that behavior).
Formula
Effective ACL permission
effective = acl_entry_perms AND acl_mask
- P
- requested permission bits for the ACL entry
- M
- ACL mask bits
Worked example
With the default values below, ACL Permission Calculator returns Effective ACL Permission of r-x. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Owner Permissions
- rwx
- Group Permissions
- r-x
- ACL Named User/Group Entry
- rwx
- ACL Mask
- r-x
Results
- Effective ACL Permission
- r-x
- Bits Restricted by Mask
- w
- Owner Permissions
- rwx
- Group Permissions
- r-x
- ACL Entry Permissions (requested)
- rwx
- ACL Mask
- r-x
Step by step
- 1Values used
- 2Effective ACL permission
- 3Effective ACL Permission= r-x
- 4Bits Restricted by Mask= w
- 5Owner Permissions= rwx
- 6Group Permissions= r-x
- 7ACL Entry Permissions (requested)= rwx
- 8ACL Mask= r-x
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Why doesn't my setfacl -m u:alice:rwx grant full access?
Even though the named entry requests rwx, the effective permission is capped by the ACL mask. If the mask is only r-x, alice's effective access is r-x regardless of what the individual entry specifies — check and widen the mask with setfacl -m m::rwx if broader access is intended.
Does the ACL mask affect the file owner's permissions?
No — the traditional owner permission bits are never affected by the ACL mask. The mask only caps the effective permissions of the owning group entry and any named user/group ACL entries, which is why getfacl always shows the owner's permissions separately from the 'group::' and mask-affected lines.
How do I see the actual effective permissions on a file with ACLs?
Run getfacl <path> — entries capped by the mask are shown with an '#effective:' comment inline indicating the actual granted permission, which is the most reliable way to confirm ACL behavior without manual bitwise calculation.