A common way to share files and/or directories with group members or others is to use the chmod command to change the permissions. However, chmod has limitations, so you may sometimes choose to use Access Control Lists (ACLs).

When you issue the command chmod g+rx filename, for example, all the members in your group (g) gain read (r) and search/execute (x) access to that file, as shown below:

% ls -l filename
-rw------- 1 zsmith s0101 9 Jun 10 12:11 filename

% chmod g+rx filename

% ls -l filename
-rw-r-x--- 1 zsmith s0101 9 Jun 10 12:11 filename

However, chmod does not allow you to select which members of your group or which specific individuals outside of your group can access your files/directories. ACLs provide a mechanism for greater control of file sharing. There are two ACL commands:

setfacl

Set file access control lists.

SYNOPSIS
       setfacl [-bkndRLPvh] [{-m|-x} acl_spec] [{-M|-X} acl_file] file ...

       setfacl --restore=file

A detailed usage explanation of setfacl and its options can be found via man setfacl. Among the options listed:

1. The -m or -M option lets you "modify" the ACL, where -m expects an ACL on the command line and -M expects an ACL from a file or from standard input
2. The -x or -X option removes the ACL entries
3. The -R or --recursive option applies operations to all files and directories recursively
4. The --test option allows you to test the effect of changing the ACL without actually changing it
5. The -b option removes all extended ACL entries except the base entries of the owner, group, and others

getfacl

Get file access control lists.

SYNOPSIS
       getfacl [-dRLPvh] file ...

       getfacl [-dRLPvh] -

A detailed usage explanation of getfacl and its options can be found via man getfacl.

Note: Before you grant another user or group access to certain files or directories, make sure that access to the parent directory (where the files or directories reside) is also allowed.

Example 1

To allow another user (jbrown) to have read/execute (rx) permission on a file (filename) and to view the ACL before and after an ACL change:

% ls -l filename
-rw------- 1 zsmith s0101 9 Jun 10 12:11 filename

% getfacl filename
# file: filename
# owner: zsmith
# group: s0101
user::rw-
group::---
other::---

% setfacl -m u:jbrown:rx filename

% getfacl filename
# file: filename
# owner: zsmith
# group: s0101
user::rw-
user:jbrown:r-x
group::---
mask::r-x
other::---

% ls -l filename
-rw-r-x---+ 1 zsmith s0101 9 Jun 10 12:11 filename

Example 2

To remove all extended ACLs in Example 1 except the base entries of the owner, group, and others:

% setfacl -b filename

% ls -l filename
-rw------- 1 zsmith s0101 9 Jun 10 12:11 filename

% getfacl filename
# file: filename
# owner: zsmith
# group: s0101
user::rw-
group::---
other::---

Example 3

Continuing from Example 1, to test the granting of read/execute (rx) access to another group (group id 24176) without actually doing it:

% setfacl --test -m g:24176:rx filename 
filename: u::rw-,u:jbrown:r-x,g::---,g:g24176:r-x,m::r-x,o::---,*  

% getfacl filename 
# file: filename 
# owner: zsmith 
# group: s0101 
user::rw- 
user:jbrown:r-x 
group::--- 
mask::r-x 
other::---

Example 4

To allow another user (jbrown) recursive access to a directory (dir.abc which contains a file filename):

% ls -ld dir.abc
drwx------ 2 zsmith s0101 17 Jun 10 13:19 dir.abc

% ls -l dir.abc
total 0
-rw------- 1 zsmith s0101 0 Jun 10 13:19 filename

% setfacl -R -m u:jbrown:rx dir.abc

% getfacl dir.abc
# file: dir.abc
# owner: zsmith
# group: s0101
user::rwx
user:jbrown:r-x
group::---
mask::r-x
other::---

% getfacl dir.abc/filename
# file: dir.abc/filename
# owner: zsmith
# group: s0101
user::rw-
user:jbrown:r-x
group::---
mask::r-x
other::---

% ls -ld dir.abc
drwxr-x---+ 2 zsmith s0101 17 Jun 10 13:19 dir.abc

% ls -l dir.abc
total 0
-rw-r-x---+ 1 zsmith s0101 0 Jun 10 13:19 filename

Example 5

Continuing from Example 4, to recursively remove all permissions user jbrown for a directory:

% setfacl -R -x u:jbrown dir.abc

% getfacl dir.abc
# file: dir.abc
# owner: zsmith
# group: s0101
user::rwx
group::---
mask::---
other::---

% getfacl dir.abc/filename
# file: dir.abc/filename
# owner: zsmith
# group: s0101
user::rw-
group::---
mask::---
other::---

For more information on ACLs, read man acl.