In an Access Control List (ACL) enabled file, which component defines the maximum effective permissions that can be granted to all entries?

• A. The file owner
• B. The ACL mask
• C. The default ACL
• D. The owner permissions

Answer: (B)

In POSIX ACLs, the component that sets the upper limit on what any named user or named group can receive is the mask entry. It acts as a cap for all user and group entries, so the effective permissions for those entries are the intersection of what the entry requests and what the mask allows. The owner’s permissions and the world/other permissions are governed by the traditional owner, group, and other bits (and the world entry in the ACL), and are not constrained by the mask in the same way. If a named entry asks for more rights than the mask permits, the mask wins and the entry’s actual rights are limited accordingly. This is why the mask defines the maximum effective permissions that can be granted to all entries.