nerdexam
Linux_Foundation

LFCS · Question #364

When adding additional users to a file's extended ACLs, what is true about the default behaviour of the ACL mask for the file?

The correct answer is D. The mask is modified to be the union of all permissions of the owning group and all named users and groups. When adding new users or groups to a file's extended ACLs, the ACL mask is automatically updated to reflect the union of permissions for all mask-affected entries.

Submitted by zhang_li· Apr 18, 2026User and Group Management

Question

When adding additional users to a file's extended ACLs, what is true about the default behaviour of the ACL mask for the file?

Options

  • AThe mask is modified to be the union of all permissions of the file owner, owning group and all named
  • BThe mask is left unchanged.
  • CIf required, a warning is printed indicating that the mask is too restrictive for the permissions being granted.
  • DThe mask is modified to be the union of all permissions of the owning group and all named users and groups.

How the community answered

(36 responses)
  • A
    3% (1)
  • B
    6% (2)
  • D
    92% (33)

Why each option

When adding new users or groups to a file's extended ACLs, the ACL mask is automatically updated to reflect the union of permissions for all mask-affected entries.

AThe mask is modified to be the union of all permissions of the file owner, owning group and all named

The file owner's permissions are not included in the calculation of the ACL mask; the mask only applies to the owning group, named users, and named groups.

BThe mask is left unchanged.

The mask is not left unchanged by default; it is automatically updated to reflect the new set of permissions for affected entries.

CIf required, a warning is printed indicating that the mask is too restrictive for the permissions being granted.

While a restrictive mask could indirectly limit newly granted permissions, the default behavior is to recalculate the mask, not just print a warning when it's too restrictive.

DThe mask is modified to be the union of all permissions of the owning group and all named users and groups.Correct

By default, when `setfacl` is used to add new named user or group entries, the ACL mask is automatically adjusted to reflect the union of permissions granted to the file's owning group, all named users, and all named groups, ensuring it acts as an effective upper limit for these entries.

Concept tested: Linux ACL mask recalculation

Source: https://www.redhat.com/sysadmin/linux-access-control-lists

Topics

#ACLs#File Permissions#ACL Mask#Access Control

Community Discussion

No community discussion yet for this question.

Full LFCS Practice