This page explains advanced Linux permission mechanisms that extend or modify standard file access controls.
ACLs allow setting file permissions for multiple users or groups, beyond the traditional owner/group/others model.
mount | grep acl
getfacl filename
setfacl -m u:username:rw file.txt # Add RW access for user
setfacl -m g:groupname:r file.txt # Add Read for group
setfacl -x u:username file.txt # Remove ACL for user
setfacl -R -m u:username:rwx directory/
setfacl -b file.txt
These special bits modify file/directory behavior in specific ways.
setuid — Run as File Owner (User ID)When applied to executables, users run the file as the file’s owner (usually root).
Set:
chmod u+s script.sh
Example:
-rwsr-xr-x root some-binary
Use Case: /usr/bin/passwd uses setuid to allow users to change their password, even though the file modifies /etc/shadow (owned by root).
setgid — Run as Group or Inherit GroupSet:
chmod g+s shared_dir/
Example (directory):
drwxr-sr-x group shared_dir
When applied to a directory, users can only delete their own files, even if others have write access to the directory.
Set:
chmod +t /shared/tmp/
Example:
drwxrwxrwt tmp
Common Use Case: /tmp directory — anyone can write, but only file owners can delete their files.
| Bit | Purpose | Set With | Applies To |
|---|---|---|---|
setuid |
Run as file owner | chmod u+s |
Executables |
setgid |
Inherit group / run as group | chmod g+s |
Files/Dirs |
sticky |
Only owner can delete their files | chmod +t |
Directories |
| Feature | Traditional | ACL |
|---|---|---|
| One user perm | ✅ | ✅ |
| One group perm | ✅ | ✅ |
| Multiple users/groups | ❌ | ✅ |
| Fine-grained control | ❌ | ✅ |
getfacl before assuming default permissions./tmp.# Example: Add read/write for 'devuser' without changing ownership
setfacl -m u:devuser:rw project.log