setfacl Command Not Found and Operation Not Supported: How to Fix Both in Linux

Updated: 9 October 2026 · Applies to: acl 2.3.1 to 2.4.0 on Debian 13, Ubuntu 24.04 and 26.04, AlmaLinux 10, Rocky Linux 9, Fedora 44 and Alpine 3.24

setfacl: command not found means the acl package is not installed. Install it and the command works straight away:

sudo apt install acl     # Debian, Ubuntu
sudo dnf install acl     # AlmaLinux, Rocky Linux, RHEL, Fedora
apk add acl              # Alpine

If setfacl is installed but prints Operation not supported, the file system that holds the file does not support POSIX ACLs or has them switched off. Section 3 shows how to find and fix that.

1. Fix "setfacl: command not found"

setfacl, getfacl and chacl all come from the acl package. On Debian and Ubuntu it is an optional package, and it was missing in every minimal image we tested (Debian 13, Ubuntu 24.04 and 26.04, AlmaLinux 10, Rocky Linux 9, Fedora 44 and Alpine), so minimal installs, cloud images and containers often don’t have it:

$ setfacl -m u:nobody:r /tmp/report.txt
bash: setfacl: command not found

1. Install the package with the command for your distribution (above). On Debian and Ubuntu run sudo apt update first if the package list is old.
2. Check that it works:

   $ setfacl --version
   setfacl 2.3.2

3. If you are not sure which package holds a command, ask the package manager:

   $ dpkg -S /usr/bin/setfacl
   acl: /usr/bin/setfacl
   
   $ dnf provides /usr/bin/setfacl      # first line of the output
   acl-2.3.2-4.el10.x86_64 : Access control list utilities

Versions we found: acl 2.3.2 on Debian 13, Ubuntu 24.04 and 26.04, AlmaLinux 10 and Alpine 3.24, 2.3.1 on Rocky Linux 9 and 2.4.0 on Fedora 44. The examples below were run with 2.3.2 on Debian 13.

2. Check that ACLs work

Give the user nobody read and write access to a file, then read the ACL back:

$ sudo setfacl -m u:nobody:rw /tmp/report.txt
$ getfacl -p /tmp/report.txt
# file: /tmp/report.txt
# owner: root
# group: root
user::rw-
user:nobody:rw-
group::r--
mask::rw-
other::r--

$ ls -l /tmp/report.txt
-rw-rw-r--+ 1 root root 0 Oct  9 17:58 /tmp/report.txt

The + after the permissions in ls -l shows that the file has an ACL. Without -p, getfacl prints the harmless note Removing leading '/' from absolute path names. For shared folders, recursive (-R) and default (-d) ACLs and removing entries, see how to configure ACLs on Linux.

3. Fix "setfacl: Operation not supported"

This error comes from the file system, not from setfacl. We got it on /proc, which has no ACL support:

$ setfacl -m u:nobody:r /proc/version
setfacl: /proc/version: Operation not supported

You get the same message on a disk or share whose file system cannot store ACLs.

1. Find the file system and its mount options:

   $ findmnt -T /dev/shm
   TARGET   SOURCE FSTYPE OPTIONS
   /dev/shm shm    tmpfs  rw,nosuid,nodev,noexec,relatime,size=64000k,inode64

   Replace /dev/shm with your own path. Look at FSTYPE and check OPTIONS for noacl.

2. Match the file system type:
   • ext4 (the default on Debian and Ubuntu): the Linux kernel (built with ext4 ACL support, as distribution kernels are) turns ACLs on for every ext4 mount; the defaults stored in the file system (the Default mount options line of tune2fs -l) do not change that. Only the old noacl mount option turned them off, and since Linux 6.1 ext4 no longer accepts it at all (we checked the kernel source). If your server runs an older kernel (uname -r), remove noacl from the line in /etc/fstab and run sudo mount -o remount,acl /data (use your mount point). On a current kernel, ext4 is not the cause: check the next items.
   • XFS (the default on AlmaLinux, Rocky Linux and RHEL): ACL support is always on, and XFS has no acl or noacl mount option. See XFS will not mount with the noacl option.
   • Btrfs: on by default; the noacl mount option turns it off.
   • tmpfs (/dev/shm and, on some systems, /tmp): supported; setfacl worked in our test.
   • ZFS on Linux: the acltype property is off by default. Turn it on per dataset with sudo zfs set acltype=posix pool/dataset; OpenZFS also recommends xattr=sa with it.
   • NFS version 4: uses its own ACL format. Install nfs4-acl-tools (available on all the distributions above) and use nfs4_setfacl and nfs4_getfacl.
   • FAT and exFAT (USB sticks, some external disks): no Linux owners or ACLs. Set access when mounting with the uid=, gid= and umask= options instead.
   • /proc and /sys: virtual file systems; ACLs are not possible there.
3. Run the setfacl command again and check the result with getfacl.

Inside Docker or Podman containers, setfacl worked on the container’s own overlay file system in our test. A folder mounted into a container follows the rules of the host file system it comes from.

4. Other setfacl errors

• setfacl: Option -m: Invalid argument near character 3: the user or group in the rule does not exist (character 3 is where the name starts in u:alice:rwx). Create the account first, or use the numeric ID: setfacl -m u:1234:rw file works even without a matching user.
• setfacl: /tmp/rootfile: Operation not permitted: only the file’s owner or root can change its ACL. Run the command with sudo.
• setfacl: /tmp/missing.txt: No such file or directory: check the path.

macOS has no setfacl: it sets ACLs with chmod +a, for example chmod +a "admin allow write" file1, and shows them with ls -le. For ordinary permissions and ownership on Linux, see making sense of 755 and rwxr-xr-x and change the owner of a file with chown.