{
  "slug": "posix-access-control-list",
  "term": "POSIX access control list",
  "aliases": [
    "POSIX ACL"
  ],
  "definition": "A POSIX access control list specifies discretionary file permissions for the owner, named users, owning and named groups, and others.",
  "note": "Scope: Linux implements the ACL model derived from POSIX.1e draft 17; that work did not become a completed POSIX standard. Access ACLs govern an object; default ACLs on directories initialize new objects. [acl]\n\nMode mapping: with an extended ACL, group-class mode bits represent the mask rather than the owning-group entry alone. A mode-only copy therefore need not preserve the source policy. [acl]\n\nRecovery control: Hesela's rsync 3.2.7 probe preserved payload and mode 0660 with -a but lost the named-user entry and changed the owning-group entry to read/write. -aA preserved the ACL; -aX did not. These are metadata observations, not impersonated access tests. [hesela-acl]\n\nAccess selection: owner checks precede named users; a matching named-user entry that denies a requested operation after masking does not fall through to group or other permissions. Per-entry intersections are therefore not a complete authorization test. [acl]",
  "related": [
    "acl-mask",
    "default-acl",
    "backup-verification"
  ],
  "citations": [
    {
      "id": "acl",
      "title": "Linux ACL project: acl(5), permission-bit correspondence and object creation",
      "url": "https://man7.org/linux/man-pages/man5/acl.5.html",
      "accessed": "2026-10-19"
    },
    {
      "id": "rsync",
      "title": "Rsync manual: --archive, --acls and --xattrs",
      "url": "https://download.samba.org/pub/rsync/rsync.1",
      "accessed": "2026-10-19"
    },
    {
      "id": "hesela-acl",
      "title": "Restoring Linux ACLs: identical bytes, different permissions",
      "url": "https://hesela.com/analyses/posix-acl-restore-permissions/",
      "accessed": "2026-10-19"
    }
  ],
  "status": "shipping",
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-19",
  "advantages": [],
  "limitations": [
    "Preserving metadata alone does not establish successful access under the destination's identities and security policy."
  ]
}