ACLs and Extended Attributes

File Permissions and Ownership covers the standard model: one owner, one group, one "other" bucket. That's enough for most cases, but breaks down the moment you need "user alice AND the developers group AND user bob, but with different access for each" on a single file - which is exactly what ACLs add.

The limitation ACLs solve

A file can only belong to one group at a time, so granting different access to two different groups on the same file is impossible with chmod/chgrp alone - the usual workaround is creating a new group that's the union of the two, which doesn't scale as access needs get more specific. ACLs (Access Control Lists) let you grant permissions to any number of additional specific users or groups, on top of the standard owner/group/other bits.

Viewing and setting ACLs

getfacl report.csv

# file: report.csv
# owner: alice
# group: alice
user::rw-
group::r--
other::---

Adding an extra user with read access, without changing alice's ownership or the standard permission bits at all:

setfacl -m u:bob:r-- report.csv
getfacl report.csv

user::rw-
user:bob:r--
group::r--
mask::r--
other::---

setfacl -m g:auditors:r-- report.csv    # grant a group
setfacl -x u:bob report.csv             # remove bob's entry
setfacl -b report.csv                   # remove all ACL entries

ls -l shows a + after the permission bits on any file with an ACL set, as a hint that getfacl is needed for the full picture:

-rw-r--r--+ 1 alice alice 1234 Aug 29 10:00 report.csv

Default ACLs: inherited by new files

Set on a directory, a default ACL automatically applies to every new file created inside it afterward - useful for a shared project directory where every new file should be group-readable without remembering to chmod each one individually:

setfacl -d -m g:developers:rwx /srv/project/

Extended attributes (xattrs)

Beyond permissions entirely, extended attributes attach arbitrary name/value metadata to a file, used by specific tools and kernel features rather than typed by hand day-to-day - ACLs themselves are actually implemented as an extended attribute under the hood:

getfattr -d report.csv
setfattr -n user.comment -v "reviewed 2026-08" report.csv

The immutable bit: chattr

One specific, genuinely useful extended attribute: the immutable flag, which blocks modification or deletion even by root, overriding standard permissions entirely:

sudo chattr +i /etc/resolv.conf
lsattr /etc/resolv.conf

----i---------e------- /etc/resolv.conf

A common real use: preventing a network manager or DHCP client from silently overwriting a manually-configured /etc/resolv.conf. Remove it the same way before the file needs to be editable again:

sudo chattr -i /etc/resolv.conf

When to reach for these

Standard permissions handle the vast majority of cases and are simpler to reason about - ACLs are worth it specifically when access genuinely doesn't fit into one owner and one group, and chattr +i is worth knowing for the specific case of a config file that keeps getting overwritten by something else on the system.