> For the complete documentation index, see [llms.txt](https://docs.weka.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.weka.io/weka-filesystems-and-object-stores/posix-acls-on-the-weka-client/manage-posix-acls-weka-client.md).

# Manage POSIX ACLs WEKA client

Manage POSIX ACLs on a WEKA filesystem that is mounted with the native client to grant fine-grained access to specific users and groups. For the background on how WEKA applies POSIX ACLs.

## Before you begin

* Mount the filesystem with ACL support enabled by adding the `acl` mount option. This option enables POSIX ACL handling and enforcement on the WEKA filesystem mount.
* Install the standard `acl` package on the client server .
* Review the metadata cost in [POSIX ACLs on the WEKA client](/weka-filesystems-and-object-stores/posix-acls-on-the-weka-client.md) before you enable ACL support on a production mount.

## View mode bits and ACL entries

1. List the mode bits:

   ```bash
   ls -l <path>
   ```

   A `+` after the mode bits indicates an ACL, for example `-rw-r-----+`.
2. List the ACL entries:

   ```bash
   getfacl <path>
   ```

   Example output:

   ```bash
   # file: data.txt
   # owner: bob
   # group: research
   user::rw-
   user:alice:r--
   group::r--
   mask::r--
   other::---
   ```

   The `user::` and `group::` lines correspond to the owner and the owning group. Named entries such as `user:alice:` form the extended part of the ACL. The `mask::` line limits the effective permissions of named users and groups.

## Grant a user access on a directory

1. Grant the user read, write, and conditional execute:

   ```bash
   setfacl -m u:alice:rwX /mnt/weka/projectA
   ```

   Capital `X` sets execute only where execute already applies, such as directories or files that already carry execute. For a directory, execute means traverse or search.
2. Verify the change:

   ```bash
   getfacl /mnt/weka/projectA
   ```

## Remove a user ACL entry

1. Remove the entry:

   ```bash
   setfacl -x u:alice /mnt/weka/projectA
   ```
2. Verify the change:

   ```bash
   getfacl /mnt/weka/projectA
   ```

## Set a default ACL for inheritance

1. Grant the user access on new items created under the directory:

   ```bash
   setfacl -m d:u:alice:rwX /mnt/weka/projectA
   ```
2. Verify that the output includes `default:` lines:

   ```bash
   getfacl /mnt/weka/projectA
   ```

## Apply ACLs recursively

1. Apply the ACL to all existing files and subdirectories:

   ```bash
   setfacl -R -m u:alice:rwX /mnt/weka/projectA
   ```
2. Set a default ACL so new children inherit the same entries:

   ```bash
   setfacl -m d:u:alice:rwX /mnt/weka/projectA
   ```

## Back up and restore ACLs

1. Back up the ACLs before large-scale changes:

   ```bash
   getfacl -R /mnt/weka/projectA > /tmp/projectA.acl.backup
   ```
2. Restore the ACLs from the backup:

   ```bash
   setfacl --restore=/tmp/projectA.acl.backup
   ```

**Related topics**

[POSIX ACLs on the WEKA client](/weka-filesystems-and-object-stores/posix-acls-on-the-weka-client.md)

[Mount filesystems](/weka-filesystems-and-object-stores/mounting-filesystems.md)

[Manage the NFS protocol](/additional-protocols/nfs-support.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.weka.io/weka-filesystems-and-object-stores/posix-acls-on-the-weka-client/manage-posix-acls-weka-client.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.