{
  "slug": "default-acl",
  "term": "Default ACL",
  "aliases": [
    "POSIX default access control list"
  ],
  "definition": "A default ACL is a directory-associated permission template used to initialize the access ACL of newly created child objects.",
  "note": "Creation: on Linux, a default ACL replaces normal umask processing, but requested creation-mode bits still constrain the inherited access ACL. This differs from the ACL mask itself. [umask]\n\nMeasured contrast: with umask 0077, a requested 0666 creation yielded 0600 without a default ACL but 0660 with the probe's template. Requesting 0600 under the template retained the named entry while masking its permissions to zero. [hesela-acl]\n\nRecovery scope: preserve directory defaults separately from current file ACLs when future child creation is part of the required behavior. Do not assume changing a default retroactively updates existing children. [acl]",
  "related": [
    "posix-access-control-list",
    "acl-mask",
    "backup-verification"
  ],
  "citations": [
    {
      "id": "acl",
      "title": "Linux ACL project: acl(5), permission-bit correspondence and object creation",
      "url": "https://man7.org/linux/man-pages/man5/acl.5.html",
      "accessed": "2026-10-19"
    },
    {
      "id": "umask",
      "title": "Linux man-pages: umask(2), interaction with default ACLs",
      "url": "https://www.man7.org/linux/man-pages/man2/umask.2.html",
      "accessed": "2026-10-19"
    },
    {
      "id": "hesela-acl",
      "title": "Restoring Linux ACLs: identical bytes, different permissions",
      "url": "https://hesela.com/analyses/posix-acl-restore-permissions/",
      "accessed": "2026-10-19"
    }
  ],
  "status": "shipping",
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-19",
  "advantages": [],
  "limitations": [
    "Preserving metadata alone does not establish successful access under the destination's identities and security policy."
  ]
}