Implement Access Control Lists (ACLs) for Fine-Grained Permissions

Posted January 19Jan 19

You are reading Part 38 of the 57-part series: Harden and Secure Linux Servers. [Level 4]

This series covers progressive security measures, from fundamental hardening techniques to enterprise-grade defense strategies. Each article delves into a specific security practice, explaining its importance and providing step-by-step guidance for implementation.

To explore more security best practices, visit the main guide for a full breakdown of all levels and recommendations.

Linux file permissions (rwx) only allow owner, group, and others access controls, which can be limiting in multi-user environments. Access Control Lists (ACLs) provide more flexibility, allowing you to:

✅ Grant specific users or groups different levels of access to files and directories.
✅ Define multiple permission rules beyond standard owner/group/others.
✅ Enhance security by limiting access to sensitive data on a need-to-know basis.

By implementing ACLs, you control access at a more granular level, improving security and system management.

How to Implement ACLs in Linux

1. Enable ACL Support (If Not Already Enabled)

Most modern Linux distributions have ACLs enabled by default, but you can verify and enable them if needed.

Check if ACLs Are Enabled on Your Filesystem

sudo mount | grep acl

(If ACLs are enabled, you should see acl in the mount options.)

Enable ACLs (If Not Already Active)

For EXT4 or XFS Filesystems:

Edit the /etc/fstab file:
```
sudo nano /etc/fstab
```
Find your root (/) or target filesystem entry and add acl to the options.
```
UUID=xxxx-xxxx-xxxx / ext4 defaults,acl 0 1
```
Remount the filesystem to apply changes:
```
sudo mount -o remount,acl /
```

For XFS filesystems, ACLs are enabled by default.

2. Set Fine-Grained Permissions Using ACLs

Use setfacl to define custom file permissions for individual users or groups.

Grant User-Specific Access to a File

sudo setfacl -m u:username:rwx /path/to/file

(Gives username full read/write/execute (rwx) access to /path/to/file.)

Grant Group-Specific Access to a File

sudo setfacl -m g:groupname:rx /path/to/file

(Grants groupname read (r) and execute (x) permissions, but no write (w) access.)

Allow Multiple Users with Different Permissions

sudo setfacl -m u:admin:rwx -m u:developer:rw /path/to/file

(Gives admin full access, but developer only read/write access.)

Set Recursive ACLs for a Directory

sudo setfacl -R -m u:username:rwx /path/to/directory

(Applies ACLs to all files inside /path/to/directory.)

3. Verify ACL Settings on Files and Directories

Use getfacl to view ACL rules for a file or directory.

getfacl /path/to/file

Example output:

# file: /path/to/file
# owner: root
# group: root
user::rw-
user:admin:rwx
user:developer:rw-
group::r--
mask::rwx
other::r--

(Shows custom ACLs assigned to admin and developer users.)

4. Remove or Reset ACLs

Remove a specific user's ACL rule:

sudo setfacl -x u:username /path/to/file

Remove all ACL rules from a file:
```
sudo setfacl -b /path/to/file
```
Remove all ACLs recursively from a directory:
```
sudo setfacl -R -b /path/to/directory
```

5. Make ACL Permissions Default for New Files (Default ACLs)

To automatically apply ACLs to new files in a directory:

sudo setfacl -m d:u:username:rwx /path/to/directory

(All new files created in /path/to/directory will inherit these permissions.)

Best Practices for ACL Management

✅ Use ACLs for shared folders and multi-user environments where standard chmod permissions are insufficient.
✅ Audit ACL rules periodically to ensure security compliance (getfacl -R /important/directory).
✅ Document ACL changes to track who has access to critical files.
✅ Combine ACLs with other security measures, such as SELinux or AppArmor, for enhanced security.

By implementing Access Control Lists (ACLs), you fine-tune user permissions, minimize security risks, and prevent unauthorized access to sensitive files, ensuring stronger access control in your Linux environment.

Quote

Sign In