Granting One User Write Access Without chmod 777: Using POSIX ACLs on Linux

A common shortcut for giving a deploy user write access to a single directory is chmod 777, which exposes the files to every account on the host. Adding the user to the directory's group is another option, but it grants that group's access everywhere it applies and may not take effect in an already-running session. POSIX ACLs offer a per-object alternative that grants permissions to a named user or group without changing ownership or opening access to everyone. The article explains that ACLs add named entries alongside the traditional owner, group, and other bits, with a mask entry acting as a ceiling on named users and groups. It walks through setting up a setgid shared directory and granting a deploy user access with setfacl, noting that the capital X flag grants execute only to directories.