This is similar to another question, but it does not seem like it explains the behavior I'm seeing. Below I am adding a specific user to get rx permissions on the Apache log access logs. However, even after adding the ACL, the ec2-user cannot cat the file.
[root]# setfacl -m u:ec2-user:rx /var/log/httpd/access_log-20170419 [root]# getfacl /var/log/httpd/access_log-20170419 getfacl: Removing leading '/' from absolute path names # file: var/log/httpd/access_log-20170419 # owner: root # group: root user::rw- user:ec2-user:r-x group::r-- mask::r-x other::r-- [root]# exit exit $ whoami ec2-user $ more /var/log/httpd/access_log-20170419 /var/log/httpd/access_log-20170419: Permission denied
It looks like the ACL should take precedence.