The format for ACL output is as follows:
# file: filename
# owner: uid
# group: gid
When multiple files are specified on the command line, a blank line separates the ACLs for each file.
The ACL entries are displayed in the order in which they are evaluated when an access check is performed. The default ACL entries that may exist on a directory
have no effect on access checks.
The first three lines display the filename, the file owner, and the file group owner. Note that when only the -d option is specified and the file has no default ACL,
only these three lines are displayed.
The user entry without a user ID indicates the permissions that are granted to the file owner. One or more additional user entries indicate the
permissions that are granted to the specified users.
The group entry without a group ID indicates the permissions that are granted to the file group owner. One or more additional group entries indicate
the permissions that are granted to the specified groups.
The mask entry indicates the ACL mask permissions. These are the maximum permissions allowed to any user entries except the file owner, and to any group entries, including the file
group owner. These permissions restrict the permissions specified in other entries.
The other entry indicates the permissions that are granted to others.
The default entries may exist only for directories, and indicate the default entries that are added to a file created within the directory.
The uid is a login name or a user ID if there is no entry for the uid in the system password file, /etc/passwd.
The gid is a group name or a group ID if there is no entry for the gid in the system group file, /etc/group. The perm is a three character string composed of the letters representing the separate discretionary access rights: r (read), w (write), x
(execute/search), or the place holder character -. The perm is displayed in the following order: rwx. If a permission is not granted by an ACL entry, the place holder character appears.
If you use the chmod(1) command to change the file group owner permissions on a file
with ACL entries, both the file group owner permissions and the ACL mask are changed to the new permissions. Be aware that the new ACL mask permissions
may change the effective permissions for additional users and groups who have ACL entries on the file.
In order to indicate that the ACL mask restrict an ACL entry, getfacl displays an additional tab character, pound sign ("#"), and the actual
permissions granted, following the entry.