The mask in Unix 3-bit ACLs

You've come to this page because you've asked a question similar to the following:

What is the "mask" in Unix (and Linux) ACLs?

This is the Frequently Given Answer to such questions.

The 3-bit (i.e. "rwx") ACL system has its roots in TRUSIX. Other ACL systems, such as the NFS4-style ones in FreeBSD, MacOS, AIX, Illumos, and Solaris, work differently and this concept of a mask access control entry is not present.

What the mask is

The mask is, as the name says, a mask that is applied to mask out permissions granted by access control entries for users and groups. It is the maximum permission that may be granted by any acccess control entry, other than by a file owner or an "other" entry. Its 3 bits are bitwise-anded with the 3 bits of these other entries.

So, for example, if a user is granted rw- by an access control entry, but the mask is r--, the user will only actually have r-- access. Conversely, if a user is only granted --x by an access control entry, a mask of rwx does not grant extra permissions and the user has just --x access.

The default mask on a parent directory is the mask setting that is applied to things that are created within it. It is a form of inheritance.

Why it exists

It's a shame that IEEE 1003.1e never became a standard and was withdrawn in 1998. In practice, decades on, it's a standard that a wide range of operating systems — from Linux through FreeBSD to Solaris (alongside the NFS4-style ACLs in the latter cases) — actually implement.

IEEE 1003.1e working draft #17 makes for interesting reading, and I recommend it. In appendix B § 23.3 the working group provides a detailed, eight page, rationale for the somewhat complex way that POSIX ACLs work with respect to the old S_IRWXG group permission flags. (It's worth noting that the TRUSIX people provided much the same analysis ten years earlier.) This covers the raison d'être for the mask, which I will only précis here.

Hence an ACL system with a mask.

Further reading

© Copyright 2020 Jonathan de Boyne Pollard. "Moral" rights asserted.
Permission is hereby granted to copy and to distribute this web page in its original, unmodified form as long as its last modification datestamp is preserved.