At first I create a file and check it's standard permissions and ACL entries: $ touch file; ls -l file; getfacl file -rw-r--r-- 1 user user 0 Jul 30 16:26 file # file: file # owner: user # group: user user::rw- group::r-- other::r-- Then I set the ACL mask on the file and again check it's standard permissions and ACL entries: $ setfacl -m mask:rwx file $ ls -l file; getfacl file -rw-rwxr--+ 1 user user 0 Jul 30 16:26 file # file: file # owner: user # group: user user::rw- group::r-- mask::rwx other::r-- Note that along with ACL mask standard group permission on the file also changed. 1. What connection does exist between ACL mask and standard group permission? 2. What is the reason for coupling ACL mask and file group permissions? What logic does lay behind it? The distributions in question are Debian Linux 7.6 and CentOS 7 ------------------------------------------------- EDIT At this point I just wanted to share some findings of mine I came up with while researching the relations between standard file group permissions and ACL mask. Here are the empirical observations I found: 1. The ACL mask can be changed: 1. by directly setting it with `setfacl -m m:<perms>` command; 2. by changing file group permissions with `chmod` command (if ACL mask is already present; it may not be present because it is optional if there are no named user or group ACL permissions on the file); 3. by adding either named user or group ACL entry (mask will be automatically recalculated). 2. The mask will enforce maximum access rights (if there are ACL entries with permissions present that exceed the ACL mask permissions) only if the mask is set directly by setfacl or by modification of file group permission with chmod (not auto-calculated). Any changes to ACL entries will trigger the ACL mask automatic recalculation and effectively turn off the "enforcing mode". 3. There are a couple of side effects implicitly affecting standard file group permissions when using ACLs: 1. Named user or group ACL entry applied to a file can change the ACL mask (increase it's permissions) and hence the effective file group permissions. For example if you, as a file owner, have "rw-r--r-- jim students" permissions set on it and you also grant rw permission to the user "jack", you'll also implicitly grant rw permissions to anyone from the "students" group. 2. Stricter (less permissions) ACL mask can permanently remove corresponding standard file group permissions. E.g. if you have a file with rw standard file group permissions and you apply a read-only ACL mask to the file it's group permissions will decrease to read-only. Then if you remove all extended ACL entries (with `setfacl -b` command), the group permissions will stay read-only. This applies only to stricter ACL mask, softer ACL mask (more permissions) don't permanently alter original file group permission after it is removed.