ACL Permission Calculator
Calculate the effective permissions granted to an ACL entry after the ACL mask restricts it.
Inputs
Standard owning-user permission triplet, e.g. rwx
Standard owning-group permission triplet, e.g. r-x
Permissions granted by a setfacl -m u:username:rwx style entry
The mask entry that caps the maximum effective permission for named ACL entries
Effective ACL Permission
r-x
Bits Restricted by Mask
w
Owner Permissions
rwx
Group Permissions
r-x
ACL Entry Permissions (requested)
rwx
ACL Mask
r-x
Step by step
Values used
Owner Permissions = rwx; Group Permissions = r-x; ACL Named User/Group Entry = rwx; ACL Mask = r-x
Effective ACL permission
effective = acl_entry_perms AND acl_mask
Effective ACL Permission
= r-x
Bits Restricted by Mask
= w
Owner Permissions
= rwx
Group Permissions
= r-x
ACL Entry Permissions (requested)
= rwx
ACL Mask
= r-x
How it works
POSIX ACLs let administrators grant specific permissions to individual users or groups beyond the standard owner/group/others model, but every named ACL entry (and the owning group entry, when ACLs are present) is capped by the ACL mask — the effective permission actually granted is the bitwise AND of the entry's requested permissions and the mask. This means raising a named user's ACL entry to rwx has no effect if the mask only permits r-x; the mask must be widened first (or setfacl -m automatically recalculates it, unless the -n flag is used to suppress that behavior).
Formula
Effective ACL permission
effective = acl_entry_perms AND acl_mask
- P
- requested permission bits for the ACL entry
- M
- ACL mask bits
Frequently Asked Questions
Why doesn't my setfacl -m u:alice:rwx grant full access?
Even though the named entry requests rwx, the effective permission is capped by the ACL mask. If the mask is only r-x, alice's effective access is r-x regardless of what the individual entry specifies — check and widen the mask with setfacl -m m::rwx if broader access is intended.
Does the ACL mask affect the file owner's permissions?
No — the traditional owner permission bits are never affected by the ACL mask. The mask only caps the effective permissions of the owning group entry and any named user/group ACL entries, which is why getfacl always shows the owner's permissions separately from the 'group::' and mask-affected lines.
How do I see the actual effective permissions on a file with ACLs?
Run getfacl <path> — entries capped by the mask are shown with an '#effective:' comment inline indicating the actual granted permission, which is the most reliable way to confirm ACL behavior without manual bitwise calculation.