getfacl(1)

getfacl1

Get acl information

Usage

getfacl [-dhinqv] [file ...]

Overview

The getfacl utility writes discretionary access control information associated with the specified file(s) to standard output. If the getconf(1) utility indicates that {_POSIX_ACL_EXTENDED} is not in effect for a file then the standard discretionary access permissions are interpreted as an ACL containing only the required ACL entries.

The following option is available:

-d, --default

The operation applies to the default ACL of a directory instead of the access ACL. An error is generated if a default ACL cannot be associated with file. This option is not valid for NFSv4 ACLs.

-h

If the target of the operation is a symbolic link, return the ACL from the symbolic link itself rather than following the link.

As -h, --help on Linux.
-i

For NFSv4 ACLs, append numerical ID at the end of each entry containing user or group name. Ignored for POSIX.1e ACLs.

Not on Linux.
-n, --numeric

Display user and group IDs numerically rather than converting to a user or group name. Ignored for POSIX.1e ACLs.

-q, --omit-header

Do not write commented information about file name and ownership. This is useful when dealing with filenames with unprintable characters.

As -c, --omit-header on Linux.
-s, --skip-base

Skip files that only have a trivial ACL, as defined by acl_is_trivial_np(3). Notably, files with POSIX.1e ACLs that only represent the owner, group and other to match the mode of the file will be skipped.

-v

For NFSv4 ACLs, display access mask and flags in a verbose form. Ignored for POSIX.1e ACLs.

As -v, --version on Linux.

The following operand is available:

file

A pathname of a file whose ACL shall be retrieved. If file is not specified, or a file is specified as -, then getfacl reads a list of pathnames, each terminated by one newline character, from the standard input.

For an explanation of the ACL syntax, see the setfacl(1) manual page.

Exit status

The getfacl utility exits 0 on success, and >0 if an error occurs.

Examples

getfacl /

Retrieve ACL for the directory /.

getfacl -d /

Retrieve the default ACL for the directory /, if any.

Releases

56 releases since FreeBSD 5.0-RELEASE; the text changed 37 times.

  1. 5.0
  2. 5.1–5.2.1
  3. 5.3–5.5
  4. 6.0
  5. 6.1–6.3
  6. 6.4
  7. 7.0
  8. 7.1
  9. 7.2
  10. 7.3
  11. 7.4
  12. 8.0
  13. 8.1
  14. 8.2
  15. 8.3
  16. 8.4
  17. 9.0
  18. 9.1
  19. 9.2
  20. 9.3
  21. 10.0
  22. 10.1
  23. 10.2
  24. 10.3
  25. 10.4
  26. 11.0
  27. 11.1
  28. 11.2
  29. 11.3
  30. 11.4
  31. 12.0
  32. 12.1
  33. 12.2
  34. 12.3
  35. 12.4
  36. 13.0–13.2
  37. 13.3–14.5
  38. 15.0–16.0

--default since FreeBSD 15.0-RELEASE; --numeric since FreeBSD 15.0-RELEASE; --omit-header since FreeBSD 15.0-RELEASE; --skip-base since FreeBSD 15.0-RELEASE; -h since FreeBSD 5.1-RELEASE; -i since FreeBSD 8.1-RELEASE; -n since FreeBSD 8.1-RELEASE; -q since FreeBSD 6.1-RELEASE; -s since FreeBSD 15.0-RELEASE; -v since FreeBSD 8.1-RELEASE.

Standards

The getfacl utility is expected to be IEEE Std 1003.2c compliant.

History

Extended Attribute and Access Control List support was developed as part of the TrustedBSD Project and introduced in FreeBSD 5.0.

Authors

Robert N M Watson

From base 16.0-CURRENT-20261027-61c70dc16a79 in FreeBSD 16.0-CURRENT (2026-10-27). Parsed by carta from the page's mdoc source.