Recording rights for an object
ACLs organize rights around an object, such as reading for one user and reading plus writing for a group. Presence in a list does not imply every operation is allowed.
Per-object lists express local grants but need maintenance. NIST notes that unreviewed changes in subjects or context can leave accumulated privileges. The representation does not automatically perform lifecycle administration.
References: [1]
Linux effective rights also depend on a mask
Linux distinguishes owner, named users, groups and other entries. Its mask caps named-user and relevant group permissions: an rw entry under an r-only mask does not grant writing.
The mask excludes owner and other entries. With an extended ACL, group mode bits correspond to the mask rather than necessarily the owning-group entry, affecting interpretation of mode changes.
References: [2]
Default ACLs initialize newly created objects
A directory’s access ACL protects that directory; its default ACL initializes new objects, constrained by requested mode permissions. Inheritance does not bypass those creation limits.
Checks follow defined matching paths rather than adding every entry. A denied matching named user cannot fall back to other. These are Linux file-ACL semantics, not a universal algorithm for every ACL.
References: [2]