Lion Cipher Lab
Grant one extra user access with POSIX ACLs (fine-grained permissions beyond chmod)
- Identity & Access Management
- Intermediate
- ~35 min
- Free · no account required
Why it matters
Standard Unix permissions give you exactly three doors: the owner, one group, and everyone else. The moment you need to let ONE extra person read a file without also handing it to the whole group — or to the world — classic chmod can't do it, and the lazy fix is almost always 'chmod 777' or 'add them to the group,' both of which quietly over-grant. POSIX ACLs are the right-sized tool: they attach per-user and per-group rules directly to a file, so you grant precisely the access needed and nothing more. Knowing when (and when not) to reach for them is core identity-and-access work on any Linux…
What you'll learn
- POSIX ACLs (setfacl / getfacl)
- fine-grained least privilege on Linux
- the ACL mask and effective permissions
- default (inherited) ACLs on directories
- backing up and restoring ACLs
Steps in this lab
- The wall chmod hits (and why ACLs exist)
- Build a safe sandbox (and keep a way back in)
- Prove the limit: Alice can't read it, and chmod can't fix it cleanly
- getfacl: read what's really there
- setfacl: grant exactly one user, exactly read
- The mask gotcha: why a later chmod can silently shrink an ACL
- Default ACLs: make a directory hand down rules automatically
- Clean up, back up, and restore ACLs
- The judgment: ACLs vs. groups — and when NOT to use ACLs