I'm trying to add a user to have permission to access a particular directory on a linux filesystem.

I saw this answer here: https://superuser.com/questions/235297/allow-specific-user-permission-to-read-write-my-folder, and ran:

setfacl -m user:tom:rwx /home/to/folder

However, when I run ls -l the user is not shown as having access to the directory, and I cannot access it as that user.

Is there another way to add a particular user to the directory? I don't want to add the user as the owner of the directory, or add the user to the owner group as this would affect that users' access across the entire system.

Any help would be greatly appreciated!

  • 1
    What happens when you "cannot access it"? Do you have ACL support enabled for the filesystem? Did setfacl succeed? ls isn't going to show anything regardless. You can edit your question. Apr 10, 2018 at 1:43
  • facls are not a nice way to solve permissions issue - it is a quick fix solution which does not scale and is difficult to audit. "I don't want to ....add the user to the owner group" implies your permirrions model is wrong.
    – symcbean
    Jun 1 at 10:52

1 Answer 1


ACL entries still follow the same rules regarding access that primary attributes do. Remember that the user needs at least r-x to be able to list the files and change to the directory, and at least r-- to be able to read the files. If you don't actually give them permissions to the files, they won't be able to open anything. As well, if the user doesn't have at least --x permissions (preferably r-x) to the intermediate directories, they won't be able to traverse to the directory location.

There are two places where you have to look when you are determining access rights. Given the following example:

drwxrwx---+  5 DOMAIN\erik     DOMAIN\domain users    4096 Apr 11  2017  documents
  • The primary attributes: these are what you see when you run ls -l. Only one user and group can be specified here (there's no room to put more!), which is why you don't see any other users.
  • The ACL (access control list): there are additional users and groups who have permissions beyond the primary attributes. They are indicated with a + after the permissions and can be seen by running getfacl (this is from a Samba-shared directory):

    $ getfacl directory
    # file: directory
    # owner: DOMAIN\134erik
    # group: DOMAIN\134domain\040users

    (Directories will have default entries; files won't.)

    As you can see, the ACL allows for many entries and you can indicate what the default attributes (for new files and directories) are; additionally, getfacl shows the primary attributes as comments at the top.

  • Directories do not necessarily have default ACL. Jun 1 at 2:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .