{
  "slug": "acl-mask",
  "term": "ACL mask",
  "aliases": [
    "POSIX ACL effective rights mask"
  ],
  "definition": "A POSIX ACL mask bounds the effective permissions of named-user, owning-group and named-group entries without masking the owner or other entry.",
  "note": "Stored versus effective: an entry can retain write permission while a read-only mask makes it ineffective. Widening the mask can reactivate that permission without editing the named entry. [acl]\n\nEditing: setfacl normally recalculates the mask from the union of affected entries unless a mask is supplied explicitly or -n is used. A narrow-looking edit can therefore change effective rights elsewhere in the ACL. [setfacl]\n\nRecovery order: chmod modifies the mask when present. Hesela's control applied conflicting ACL and mode targets in both orders and obtained different final policies with identical bytes. [hesela-acl]",
  "related": [
    "posix-access-control-list",
    "default-acl",
    "backup-verification"
  ],
  "citations": [
    {
      "id": "acl",
      "title": "Linux ACL project: acl(5), permission-bit correspondence and object creation",
      "url": "https://man7.org/linux/man-pages/man5/acl.5.html",
      "accessed": "2026-10-19"
    },
    {
      "id": "setfacl",
      "title": "Linux ACL project: setfacl(1), mask recalculation",
      "url": "https://man7.org/linux/man-pages/man1/setfacl.1.html",
      "accessed": "2026-10-19"
    },
    {
      "id": "hesela-acl",
      "title": "Restoring Linux ACLs: identical bytes, different permissions",
      "url": "https://hesela.com/analyses/posix-acl-restore-permissions/",
      "accessed": "2026-10-19"
    }
  ],
  "status": "shipping",
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-19",
  "advantages": [],
  "limitations": [
    "Preserving metadata alone does not establish successful access under the destination's identities and security policy."
  ]
}