The plus sign at the end
A long listing shows -rw-rw----+ on this file, and both halves of that are misleading. The trailing plus sign is the only hint that an access control list is attached, and it is easy to miss. Asking for the list shows an entry the listing never named: a second user granted read and write individually. Worse, the middle triplet that everyone reads as the group permission is not the group permission once an ACL exists - it is the mask, an upper bound on what the named entries may receive, while the real group permission here is read-only. So the familiar output understates who has access and overstates what the group gets. Recursively listing only the files that carry ACLs turns this from a trap into a two-second audit.
The permissions you see are not the permissions that apply.
You check a file with the usual command, read the three groups of letters, and move on. On this file, that reading is wrong.
Look at the end of the permission string. There is a plus sign, and it is the only hint that something else applies.
Ask for the access control list, and there is an entry the listing never showed: a second user, named individually, with read and write.
And the middle triplet you read as the group permission is not that at all. It is a mask, an upper bound on what those named entries may receive. The real group permission here is read only.
So the familiar output understated who can reach the file, and overstated what the group gets. One switch lists every file carrying one of these.
Look for the plus. Then ask what is actually on the file.
#linux#security#selfhosted#infosec#sysadmin
❯ Look for the plus. Then ask what is actually on the file.