Which command revokes ACL-based write access for groups and named users on the file afile?

Question

Options

• Asetfacl -x group: * : rx, user:*: rx afile
• Bsetfacl -x mask: : rx afile
• Csetfacl ~m mask: : rx afile
• Dsetfacl ~m group: * : rx, user :*: rx afile

• A
  3% (2)
• B
  12% (8)
• C
  81% (55)
• D
  4% (3)

Explanation

Option C uses setfacl -m mask::rx afile, which modifies the ACL mask to rx (read + execute only). The mask entry acts as a permission ceiling for all named users and named groups - setting it to rx silently strips write access from all of them in one shot, without touching individual entries.

Why the distractors fail:

• A uses -x (remove/delete entries), but -x cannot accept permission values like rx - you can only specify what entry to delete, not what permissions to set. Wildcards (*) in user/group names are also invalid.
• B uses -x mask::rx, which has the same -x problem - you can't pair -x with a permission string. The correct form to delete a mask would be setfacl -x mask afile with no permissions.
• D uses -m correctly but tries to apply permissions directly to group:* and user:* with wildcards, which setfacl does not support as a glob syntax.

Memory tip: Think of the ACL mask as a dimmer switch that overrides everyone's individual settings. -m makes a change; -x expunges an entry. To cap permissions without removing ACLs, you modify the mask - so reach for -m mask::rx.

No community discussion yet for this question.