Calculate effective access permissions when POSIX ACLs override standard file mode bits.
POSIX ACLs let administrators grant specific permissions to individual users or groups beyond the standard owner/group/others model, but every named ACL entry (and the owning group entry, when ACLs are present) is capped by the ACL mask — the effective permission actually granted is the bitwise AND of the entry's requested permissions and the mask. This means raising a named user's ACL entry to rwx has no effect if the mask only permits r-x; the mask must be widened first (or setfacl -m automatically recalculates it, unless the -n flag is used to suppress that behavior).
Effective ACL permission
effective = acl_entry_perms AND acl_mask
Even though the named entry requests rwx, the effective permission is capped by the ACL mask. If the mask is only r-x, alice's effective access is r-x regardless of what the individual entry specifies — check and widen the mask with setfacl -m m::rwx if broader access is intended.
No — the traditional owner permission bits are never affected by the ACL mask. The mask only caps the effective permissions of the owning group entry and any named user/group ACL entries, which is why getfacl always shows the owner's permissions separately from the 'group::' and mask-affected lines.
Run getfacl <path> — entries capped by the mask are shown with an '#effective:' comment inline indicating the actual granted permission, which is the most reliable way to confirm ACL behavior without manual bitwise calculation.