Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 110

ACL entry owner. Other class permissions are mapped to the respective ACL entry.
However, the mapping of the group class permissions is different in the two cases.
Figure 10.1 Minimum ACL: ACL Entries Compared to Permission Bits
In the case of a minimum ACL—without mask—the group class permissions are mapped
to the ACL entry owning group. This is shown in Figure 10.1, "Minimum ACL: ACL
Entries Compared to Permission Bits" (page 98). In the case of an extended ACL—with
mask—the group class permissions are mapped to the mask entry. This is shown in
Figure 10.2, "Extended ACL: ACL Entries Compared to Permission Bits" (page 98).
Figure 10.2 Extended ACL: ACL Entries Compared to Permission Bits
This mapping approach ensures the smooth interaction of applications, regardless of
whether they have ACL support. The access permissions that were assigned by means
of the permission bits represent the upper limit for all other "fine adjustments" made
with an ACL. Changes made to the permission bits are reflected by the ACL and vice
versa.
10.4.2 A Directory with an Access ACL
With getfacl and setfacl on the command line, you can access ACLs. The usage
of these commands is demonstrated in the following example.
98 Security Guide