# Become user, question about POSIX ACL support

**URL:** <https://forum.ansible.com/t/become-user-question-about-posix-acl-support/44533>\
**Category:** Get Help\
**Created:** [September 23, 2025, 8:37am UTC](https://forum.ansible.com/t/become-user-question-about-posix-acl-support/44533 "2025-09-23T08:37:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [September 23, 2025, 8:37am UTC](https://forum.ansible.com/t/become-user-question-about-posix-acl-support/44533/1 "2025-09-23T08:37:35Z")

</div>

Hi, on [Understanding privilege escalation: become — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_privilege_escalation.html#risks-of-becoming-an-unprivileged-user) the term ` POSIX.1e filesystem ACL support` is mentioned.  
What exactly does this mean?  
From [https://unix.stackexchange.com/questions/489820/why-was-posix-1e-withdrawn](https://unix.stackexchange.com/questions/489820/why-was-posix-1e-withdrawn) it seems that standard was withdrawn.

For my use case I am running stock Debian 12 or 13 with `ext4`, and I wonder if that is good enough

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [September 23, 2025, 12:00pm UTC](https://forum.ansible.com/t/become-user-question-about-posix-acl-support/44533/2 "2025-09-23T12:00:01Z")

</div>

My reading is that it will attempt to use `setfacl` if it can. `man setfacl` has a section titled “CONFORMANCE TO POSIX 1003.1e DRAFT STANDARD 17” and lists changes in behavior if the environment variable POSIXLY\_CORRECT is defined. It isn’t clear (to me) whether Ansible defines POSIXLY\_CORRECT when it attempts to use `setfacl`, which I think is at the crux of your question.

> [@dnmvisser](#):
>
> For my use case I am running stock Debian 12 or 13 with `ext4`, and I wonder if that is good enough

That is good enough. Even if the `ext4` filesystem is mounted with extended ACLs disabled (which is unlikely), Ansible _should_ fall back on the other methods listed in the _Understanding privilege escalation_ document you cited.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [October 23, 2025, 12:00pm UTC](https://forum.ansible.com/t/become-user-question-about-posix-acl-support/44533/3 "2025-10-23T12:00:19Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.