File permission models compared: POSIX bits, POSIX ACLs, NFSv4/ZFS ACLs, NTFS and macOS ACLs

What it is

Model	Where it applies	Read command	Write command
POSIX mode bits	every Unix-like filesystem	ls -l FILE; octal via stat -c %a FILE (GNU/Linux) or stat -f %Lp FILE (FreeBSD/macOS)	chmod 640 FILE (octal or symbolic)
POSIX.1e ACLs	ext4, XFS and others on Linux, UFS on some BSDs	getfacl FILE	setfacl -m u:NAME:rw FILE
NFSv4 / ZFS ACLs	ZFS and UFS (nfsv4acls) on FreeBSD, ZFS on Solaris/illumos (OpenZFS on Linux uses POSIX ACLs instead)	FreeBSD: getfacl FILE (understands both POSIX.1e and NFSv4 ACLs); illumos/Solaris: ls -V FILE	FreeBSD: setfacl -m with NFSv4-style entries; illumos/Solaris: chmod A+ENTRY FILE
NTFS ACLs (DACLs)	NTFS on Windows	icacls FILE or Get-Acl FILE	icacls FILE /grant "NAME:(R,W)" (quote it in PowerShell, where parentheses are parsed) or Set-Acl
macOS ACLs	HFS+ and APFS, layered on top of POSIX mode bits	ls -le FILE	chmod +a "NAME allow read,write" FILE

Why it matters

Each model has its own inheritance semantics, its own way to deny (as opposed to merely not-grant) access, and its own identity namespace (numeric UIDs, SIDs, or macOS's directory service records). None of that maps cleanly onto another model; a file copied between systems keeps only what the copy tool bothers to translate, and most everyday tools (scp, a browser download, an email attachment) keep none of it.

How to apply

• Treat POSIX mode bits as the only access-control information guaranteed to survive a transfer between Unix-like systems; verify ACLs separately after any cross-system copy with getfacl/icacls/ls -le.
• On Windows, back up ACLs before changing them: icacls DIR\* /save acl.txt /t. The file stores names relative to the saved path's directory, so /restore must target that parent directory: icacls DIR /restore acl.txt, not the file itself.
• ACLs and mode bits interact differently: on Linux, chmod's group bits set the ACL mask and can narrow named-user entries; on macOS, ACL entries are evaluated before the mode bits, so narrowing the mode does not revoke an ACL grant; on ZFS, chmod rewrites the ACL according to the dataset's aclmode property and can discard entries.
• When granting cross-platform access (e.g., a Samba share backed by a POSIX filesystem, exposed with NTFS-like ACLs to Windows clients), test the effective permission from both the Unix and the Windows side, since the mapping layer can round incorrectly.

Pitfalls

• GNU cp -a preserves mode bits and POSIX ACLs, but rsync -a preserves ACLs only with -A (and extended attributes with -X); neither carries NFSv4/ZFS ACL entries onto a filesystem that has no NFSv4 ACL support.
• Assuming chmod +a syntax on macOS matches BSD setfacl; macOS ACLs use their own chmod +a/-a syntax, not the POSIX.1e setfacl command, which is not shipped on macOS at all.
• Restoring only the mode bits after an incident and considering permissions "fixed" while a leftover ACL entry from a previous grant still allows access ls -l does not show.