Home / How to restrict access to a specific user when file or directory permission is 777?

How to restrict access to a specific user when file or directory permission is 777?

To remove a user named ‘user’ access from a file/directory with full access to ‘other’.

# setfacl -m u:user:- /path/to/file_or_directory

The same can be done for a group named ‘groupname’; change u to g.

# setfacl -m g:groupname:- /path/to/file_or_directory

Check the permission with getfacl.

# getfacl /path/to/file_or_directory
# file: example/
# owner: root
# group: root
user::rwx
user:example:--- <--- user permission is set to none
group::rwx
group:groupname:--- <--- groupname permission is set to none
mask::rwx
other::rwx <--- other has full access

The Access Control List ACL is processed in the following sequence.

 Permission->ACL->SElinux

If the directory is set to 777, but the ACL for a user/group permission is set to -, then that specific user/group will not have access to the directory.

Leave a Reply