setfacl tips — authorized ACL-write literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run setfacl on the lab host (syllabus box you own or were given access to; acl package required).
2. Prefer documenting who / why / ticket before any -m / -x / -b write — never change production ACLs without change control.
3. Record short factual notes; quote short Evidence (intended user/group/mask — never secrets).
4. Optional: read-back peer → getfacl-tips.
5. Optional: mode peer → chmod-tips / ownership peer → chown-tips.
6. Prefer disposable lab paths for setfacl drills; quote getfacl afterward as Evidence.
7. Prefer minimal -m u:labuser:rX style changes the syllabus authorizes — avoid inventing ACL-bypass cookbooks.
8. Stop at literacy — no attack or unauthorized ACL-rewrite cookbooks.

Allowed framing

• Classroom labs reviewing setfacl -m / -x / -b / default ACLs on authorized disposable paths.
• Binding short factual notes as Evidence (user/group/mask — no secrets).
• Documenting expected vs observed ACL state after authorized writes for inventory notes.
• Comparing setfacl ↔ getfacl / chmod / chown / namei peer tip pages under one binder.
• Testing default-ACL (-d) writes only when the syllabus authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via setfacl.
• No intentional unauthorized ACL rewrites against foreign hosts.
• No secret-theft or privilege-widen cookbooks via ACL grants on hosts you do not own.
• No cookbooks that clear masks / grant world access on foreign paths without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with the acl tools available.
2. Prefer a throwaway lab directory and lab user before any write.
3. With authorization, run a syllabus-approved setfacl -m u:labuser:rX labdir; quote getfacl read-back as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized ACL-rewrite cookbooks.

Practical notes for authorized labs

• setfacl writes POSIX ACLs — keep Evidence labels distinct from classic chmod-tips mode bits.
• Pair with getfacl-tips for syllabus-approved read-back on lab paths.
• Mask recalculation can surprise beginners — document intended vs observed masks honestly.
• Prefer documenting user/group names and masks the syllabus authorized without dumping full privileged inspect JSON.
• Never commit setfacl change logs with secrets to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host ACL rewrites → refuse.
• Unauthorized privilege-widen / world-grant cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources