ACL entries still follow the same rules regarding access that primary attributes do. Remember that the user needs at least
r-x to be able to list the files and change to the directory, and at least
r-- to be able to read the files. If you don't actually give them permissions to the files, they won't be able to open anything. As well, if the user doesn't have at least
--x permissions (preferably
r-x) to the intermediate directories, they won't be able to traverse to the directory location.
There are two places where you have to look when you are determining access rights. Given the following example:
drwxrwx---+ 5 DOMAIN\erik DOMAIN\domain users 4096 Apr 11 2017 documents
- The primary attributes: these are what you see when you run
ls -l. Only one user and group can be specified here (there's no room to put more!), which is why you don't see any other users.
The ACL (access control list): there are additional users and groups who have permissions beyond the primary attributes. They are indicated with a
+ after the permissions and can be seen by running
getfacl (this is from a Samba-shared directory):
$ getfacl directory
# file: directory
# owner: DOMAIN\134erik
# group: DOMAIN\134domain\040users
(Directories will have
default entries; files won't.)
As you can see, the ACL allows for many entries and you can indicate what the default attributes (for new files and directories) are; additionally,
getfacl shows the primary attributes as comments at the top.