Sharing a folder with multiple users using ACLs instead of chmod 777

If you’re sharing a directory between a handful of people, the first thing most folks do is chmod 777. I’ve seen that go wrong when a rogue script deletes everything. ACLs let you fine‑tune permissions per user or group while keeping the directory’s ownership sane.

Below is a step‑by‑step guide that shows how to enable ACLs, set up a shared folder, and maintain it securely on a modern Linux system (kernel 6.x, systemd 250+). The examples use setfacl and getfacl, the standard ACL utilities that ship with most distributions.

Enabling ACL support

Most filesystems already support ACLs, but the mount option must be enabled. Check the current mount options:

$ mount | grep '^/dev/sd'
/dev/sda1 on / type ext4 (rw,relatime,data=ordered)

If acl is missing, add it to /etc/fstab:

/dev/sda1   /   ext4   defaults,acl   0   1

Then remount:

$ sudo mount -o remount,acl /

Verify with tune2fs for ext4:

$ sudo tune2fs -l /dev/sda1 | grep 'Default mount options'
Default mount options:    user_xattr acl

For XFS, ACLs are enabled by default; for Btrfs, the acl option is also default.

Choosing the right ownership

A shared directory should belong to a dedicated group that represents the collaboration. Create a group:

$ sudo groupadd shared

Add the users who need access:

$ sudo usermod -aG shared alice
$ sudo usermod -aG shared bob

Set the group ownership of the directory and enable the setgid bit so that new files inherit the group:

$ sudo mkdir /srv/shared
$ sudo chown root:shared /srv/shared
$ sudo chmod 2775 /srv/shared

2775 gives read/write/execute to owner and group, and read/execute to others, but the setgid (2) ensures new files stay in the shared group.

Granting per‑user permissions with ACLs

Now we can give each user the exact rights they need. The setfacl command modifies the ACL entries.

# Alice can read, write, and execute
$ sudo setfacl -m u:alice:rwx /srv/shared

# Bob can read and write, but not execute
$ sudo setfacl -m u:bob:rw- /srv/shared

# Carol is not yet a member of the group but should have read access
$ sudo setfacl -m u:carol:r-- /srv/shared

The ACL table for the directory now looks like this:

$ getfacl /srv/shared
# file: /srv/shared
# owner: root
# group: shared
user::rwx
user:alice:rwx
user:bob:rw-
user:carol:r--
group::rwx
mask::rwx
other::r-x

The mask entry limits the maximum permissions granted to named users and groups. In this example, the mask is rwx, so all users get the full set of permissions they were granted.

Default ACLs for new files

If users create files inside /srv/shared, those files inherit the directory’s default ACLs. Set them with -d:

$ sudo setfacl -d -m u:alice:rwx /srv/shared
$ sudo setfacl -d -m u:bob:rw- /srv/shared
$ sudo setfacl -d -m u:carol:r-- /srv/shared

Now any file created by anyone will automatically carry the same per‑user permissions. Verify:

$ sudo touch /srv/shared/test.txt
$ getfacl /srv/shared/test.txt
# file: /srv/shared/test.txt
# owner: root
# group: shared
user::rw-
user:alice:rwx
user:bob:rw-
user:carol:r--
group::rwx
mask::rwx
other::r-x

The default ACLs are applied to the file’s owner and group as well, but the mask still caps the named users’ rights.

Removing or changing ACLs

To revoke a user’s access, drop the entry:

$ sudo setfacl -x u:bob /srv/shared

To reset the ACLs to the directory’s base permissions, use -b:

$ sudo setfacl -b /srv/shared

-b removes all named user/group entries, leaving only the owner, group, and other permissions.

ACLs versus group ownership

Scenario	Traditional group	ACLs
Two users need different write permissions	Not possible – group permissions are uniform	Possible – per‑user entries
A new user joins the project	Add to group, give full group rights	Add a single ACL entry
You want to restrict a single user from a shared directory	Must change group or use `chmod 700`	Set a restrictive ACL entry

ACLs add flexibility but also add complexity. Keep the ACL table small; avoid over‑granting. For most shared projects, a single group with rwx is sufficient, and you can use ACLs only for exceptional cases.

Performance and kernel support

ACL checks are performed by the kernel’s VFS layer. On ext4 and XFS, the overhead is negligible for typical

linux open-source