ACL is NOT enabled but it's working

Question

How this is possible?

1. ACL is not enabled in /etc/fstab, and I can verify it via manually opening fstab or running sudo mount | grep -i acl.

2. But getfacl & setfacl Commands would work without any complains!

The problem is, first I need to understand why this is working, and second I need to check other systems to see if ACL support is available on them or not, so how can I do that?

ACL commands were tested on both / & /mydrive(see below for mount output).

OS Info:

uname -a:
Linux localhost 3.2.0-4-amd64 #1 SMP Debian 3.2.57-3+deb7u1 x86_64 GNU/Linux

lsb_release -a:
No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 7.5 (wheezy) Release: 7.5 Codename: wheezy

mount:
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime) proc on /proc type proc (rw,nosuid,nodev,noexec,relatime) udev on /dev type devtmpfs (rw,relatime,size=10240k,nr_inodes=384309,mode=755) devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000) tmpfs on /run type tmpfs (rw,nosuid,noexec,relatime,size=308664k,mode=755) /dev/disk/by-uuid/3180f94a-e765-44e9-93f7-33aa1c6422c0 on / type ext4 (rw,relatime,errors=remount-ro,user_xattr,barrier=1,data=ordered) tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k) tmpfs on /run/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1188500k) /dev/sda5 on /mydrive type ext4 (rw,relatime,user_xattr,barrier=1,data=ordered) rpc_pipefs on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime) binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,nosuid,nodev,noexec,relatime) fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime)

Solution

ext3/4 file systems have a default mount options attribute in their headers. You can see it with:

$ LC_ALL=C tune2fs -l /dev/device | grep 'Default mount options:'
Default mount options:    user_xattr acl

You can change it with tune2fs -o and mounting with -o noacl would override it.

When creating a new file system, mke2fs will set that based on what you specify in /etc/mke2fs.conf. For instance, mine has:

[defaults]
[...]
        default_mntopts = acl,user_xattr
[...]

However, as noted by Gilles, since 2.6.39, acl and user_xattr are on by default (provided support has been enabled in the kernel at compile time which would generally be the default). So even without the acl default mount option, acls would be enabled by default on newer kernel, and the only way to disable it would be to use mount -o noacl.

To check whether ACLs are supported, best would be to try and query them:

$ chacl -l /the/mountpoint
chacl: cannot get access ACL on '/the/mountpoint': Operation not supported

Comments

[Bachsau]

The default mount options in the superblock are stored in a bitfield , which means it can not hold arbitrary values, and "noacl" isn't part of the list. Newer file systems support a mount_opts attribute that stores strings.

[Stéphane Chazelas]

@Bachsau, there is a EXT4_DEFM_XATTR_USER in the superblock's default mount options, but since 2.6.39, that's ignored as acl is now defaulted on. The mount_opts you're refering to are the options handled by the FS driver. One of them is noacl so the user can tell the driver to disable ACLs for the mount of that FS.