Linux Commands / IT Support Guides
Inspect Linux ACLs with getfacl
A file can have access rules beyond the familiar owner, group and other permission bits. Inspect its ACL when ordinary listings do not explain the user's access.
Environment and inputs: Linux · Bash-compatible shell; package and service names vary by distribution
Try the diagnostic command
Use the stated shell and platform. Replace sample domains, addresses, services and paths with values from the system you are authorized to support.
getfacl /srv/shared/report.txtHow to read the result
Named-user or named-group entries can grant additional access. The ACL mask limits the effective permissions of applicable entries, so the displayed entry alone may overstate access.
What to do next
Compare the effective ACL with the affected account's groups and the parent directory's traversal permissions. Document intended access before making a targeted correction.
Before you make a change
The ACL utility may need installation and filesystem support. Do not remove all ACLs merely to make the file resemble another file.