hesela.devACL mask
A POSIX ACL mask bounds the effective permissions of named-user, owning-group and named-group entries without masking the owner or other entry.
Stored versus effective: an entry can retain write permission while a read-only mask makes it ineffective. Widening the mask can reactivate that permission without editing the named entry. [1]
Editing: setfacl normally recalculates the mask from the union of affected entries unless a mask is supplied explicitly or -n is used. A narrow-looking edit can therefore change effective rights elsewhere in the ACL. [2]
Recovery order: chmod modifies the mask when present. Hesela's control applied conflicting ACL and mode targets in both orders and obtained different final policies with identical bytes. [3]
Relations
Limitations
- Preserving metadata alone does not establish successful access under the destination's identities and security policy.