Access Control Lists (ACLs) – Windows icacls & Linux setfacl/getfacl

#When Basic Permissions Aren't Enough: ACLs Across Platforms#link

POSIX permissions only support one owner, one group, and 'others'. But real-world file servers need Finance to read, HR to modify, and Auditors to have read-only—all on the same directory. Access Control Lists (ACLs) provide that granularity. This lesson equips you to wield Windows icacls and Linux setfacl/getfacl to create layered, auditable file access rules that survive security audits.

Windows ACLs: The Anatomy of a Security Descriptor

Every securable object in Windows has a security descriptor containing a Discretionary ACL (DACL) and System ACL (SACL). The DACL holds Access Control Entries (ACEs) that allow or deny access to users/groups. SACL controls auditing. Using icacls, you can backup, restore, and script complex ACLs. Understanding the order of ACE evaluation (explicit deny, then explicit allow, then inherited) prevents misconfigurations.

The /t switch recurses, and the backup file can be restored with icacls /restore. This is invaluable before making bulk permission changes.

# Use PowerShell to get and set ACLs more programmatically
$acl = Get-Acl -Path "D:\Shared"
$acl.Access | Format-Table IdentityReference, FileSystemRights, AccessControlType

Linux ACLs with setfacl and getfacl

Modern Linux filesystems (ext4, xfs) support POSIX ACLs via the acl package. getfacl displays the ACL, including the traditional permission mask and any named user/group entries. setfacl -m adds entries, -x removes them. The mask entry limits the effective permissions of named groups and the owning group. It's the most confusing part: setting a named group rwx, but the mask is r--, the effective permission is r--.

Here, finance gets r-x, audit gets r--, and the mask restricts the effective permissions. The 'mask' is automatically recalculated to the union of all group permissions, but can be manually set to limit.

Default ACLs for Inheritance (Linux)

Setting a 'default' ACL on a directory causes new files and subdirectories to inherit that ACL. This is analogous to Windows inheritance. Without default ACLs, new files get only the standard POSIX permissions. Use setfacl -d to define defaults. This is essential for directories where multiple groups collaborate.

• ▪Always back up ACLs (icacls /save, getfacl -R) before bulk permission changes.
• ▪Use ACLs to grant access to multiple groups beyond the owning group.
• ▪Monitor the ACL mask on Linux—ensure it doesn't unintentionally strip permissions.
• ▪Set default ACLs on shared directories to enforce consistent permissions on new files.