What it means
Host access control lists extend basic owner-group-other permissions with named user and group entries, default inheritance, and more precise authorization for shared files and directories.
Why it matters
ACLs solve real collaboration problems, but they also make effective access less obvious and require tooling and review that account for every permission layer.
Practical focus
- Define the shared objects that cannot be governed cleanly by standard mode bits alone and the identities, roles, and resources it covers
- Implement minimal ACL entries, controlled defaults, documented ownership, and periodic recertification through least-privilege, reviewable policy
- Use effective access, inherited entries, mask behavior, and stale principals to confirm that effective access matches intended access
- Plan for an ACL mask or inherited default granting or blocking access unexpectedly, including safe recovery and break-glass handling
Common mistakes
- Granting broad access because it is easier to administer
- Changing policy without testing the effective identity context
- Allowing exceptions to persist without an owner or expiration
- Treating an ACL mask or inherited default granting or blocking access unexpectedly as a user problem instead of a control failure
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: