---
title: "File management with multiple users"
date: "2017-02-14"
category: "platform"
slug: "file-management-multiple-users"
---

Access control lists ([ACLs](https://wiki.archlinux.org/index.php/Access_Control_Lists)) provide granular file access control in multi-user environments. Instead of granting blanket access to all users on an account, ACLs let you specify exactly which users can read, write, or execute specific files and directories.

ACLs can be established by the file owner or account admin using [[scripting-with-beacon]].

### ACL Types

- **Active ACLs**: applied directly to a file or directory
- **Default ACLs**: applied to a directory so that files created within it automatically inherit the specified permissions

## Using setfacl

ACLs can be set from the [[accessing-terminal]] using `setfacl` on all [[determining-platform-version]]. `setfacl` only works on files you own. For files owned by another user, use `file_set_acls` in Beacon (see below), take ownership via [file\_chown](http://api.apnscp.com/docs/class-File_Module.html#_chown) in Beacon, or use [[elevating-privileges-with-sudo]].

### Syntax

`setfacl -m [d:]_USERNAME_:_PERMISSIONS_ _FILE_`

- `d:`: optional prefix to apply as default ACLs instead of active ACLs
- _USERNAME_ -- the user on the account to grant access to
- _PERMISSIONS_ -- a [[permissions-overview]] value between 0 and 7, or a combination of r,w,x
- `-m ...` can be repeated to apply rules for multiple users
- `-R` applies rules recursively

### Simple Example

$ setfacl -m user:tom:7 newdata.zip
$ getfacl newdata.zip
# file: newdata.zip
# owner: myadmin
# group: myadmin
user::rw-
user:tom:rwx
group::r--
mask::rwx
other::r--

### More Examples

- Grant a user read access: `setfacl -m u:lisa:r file`
- Revoke write access from all groups and named users via the effective rights mask: `setfacl -m m::rx file`
- Remove a named group entry: `setfacl -x g:staff file`
- Copy the ACL of one file to another: `getfacl file1 | setfacl --set-file=- file2`
- Copy the access ACL into the default ACL: `getfacl --access dir | setfacl -d -M- dir`

### Further Reading

See the man pages for [setfacl](https://linux.die.net/man/1/setfacl) and [getfacl](https://linux.die.net/man/1/getfacl).

## Using Beacon

[[scripting-with-beacon]] provides an alternative interface using [file\_set\_acls](http://api.apnscp.com/docs/class-File_Module.html#_set_acls) and [file\_get\_acls](http://api.apnscp.com/docs/class-File_Module.html#_get_acls). When ACLs are set via Beacon as the primary account holder, they override traditional discretionary access checks. This means you can alter ACLs on any file regardless of ownership, unlike `setfacl` which requires you to own the file.

### Setting ACLs

$ beacon eval file\_set\_acls /var/www/html redline 7
1
$ getfacl /var/www/html
getfacl: Removing leading '/' from absolute path names
# file: var/www/html
# owner: myadmin
# group: myadmin
user::rwx
user:redline:rwx
group::r-x
mask::rwx
other::r-x

### Default and Recursive ACLs

Supply _default:1_ for default ACLs and _recursive:1_ to apply recursively:

$ beacon eval file\_set\_acls /var/www/html/test redline 7 [default:1,recursive:1]
1
$ getfacl /var/www/html/test/foo
getfacl: Removing leading '/' from absolute path names
# file: var/www/html/test/foo
# owner: myadmin
# group: myadmin
# flags: -s-
user::rwx
user:redline:rwx #effective:r-x
group::rwx #effective:r-x
mask::r-x
other::--x
default:user::rwx
default:user:redline:rwx
default:group::rwx
default:mask::rwx
default:other::--x

### Clearing ACLs

To clear an ACL entry for a specific user, omit the permission parameter:

$ beacon eval file\_set\_acls /var/www/html/test redline 
$ getfacl /var/www/html/test/foo
getfacl: Removing leading '/' from absolute path names
# file: var/www/html/test/foo
# owner: myadmin
# group: myadmin
# flags: -s-
user::rwx
group::rwx #effective:r-x
mask::r-x
other::--x
default:user::rwx
default:group::rwx
default:mask::rwx
default:other::--x

### Multiple Users

To set ACLs for multiple users at once:

$ beacon eval file\_set\_acls /var/www/html/test [redline:7,apache:7]
1
$ getfacl /var/www/html/test
getfacl: Removing leading '/' from absolute path names
# file: var/www/html/test
# owner: myadmin
# group: myadmin
user::rwx
user:apache:rwx
user:redline:rwx
group::r-x
mask::rwx
other::r-x

## See Also

- [[permissions-overview]]
- [[scripting-with-beacon]]
