This is kind of a broad topic and a little too much to cover here. I'll refer you to the POSIX Access Control Lists on Linux whitepaper put together by Andreas Grünbacher of the SuSE Labs. It does a pretty good job of covering the subject and breaking it down so you understand how ACLs work.
Now let's take a look at your example and break it down.
- group (sales)
- members of sales group (bob, joe)
Now let's break down the permissions on file
/home/foo/docs/foo.txt. ACLs also encapsulate the same permissions that most people should be familiar with on Unix, mainly the User, Group, and Other bits. So let's pull those out first.
These would typically look like this in an
$ ls -l /home/foo/docs/foo.txt
-r--r----- 1 jane executives 24041 Sep 17 15:09 /home/foo/docs/foo.txt
You can see who owns the file and what the group is with these ACL lines:
# owner: jane
# group: executives
So now we get into the nitty gritty of ACLs:
This is showing that user
rw, while user
rwx. There is also a group which also has
rwx similar to joe. These permissions are as if the user column in our
ls -l output had 3 owners (jane, bob, and joe) as well as 2 groups (executives & sales). There is no distinction other than they are ACLs.
In this case we're not masking anything, it's wide open. So if users bob and joe have these lines:
Then those are their effective permissions. If the mask were like this:
Then their effective permissions would be like this:
user:bob:rw- # effective:r--
user:joe:rwx # effective:r-x
This is a powerful mechanism for curtailing permissions that are granted in a wholesale way.
NOTE: The file owner and others permissions are not affected by the effective rights mask; all other entries are! So with respect to the mask, the ACL permissions are second class citizens when compared to the traditional Unix permissions.