The classic user/group/other model is sufficient for many systems, but it cannot grant access to a fourth specific user without making the file world-readable. POSIX ACLs solve this. setfacl -m u:alice:r file grants Alice read access on a file, and multiple entries can be combined in a single invocation: setfacl -m u:alice:r,u:bob:rw,g:devops:rwx file. The matching query is getfacl file, which prints the full ACL alongside the traditional mode. ACLs may also define a default ACL on a directory — setfacl -d -m u:alice:rx dir — which automatically propagates to new files and subdirectories created inside. A web service such as www-data can therefore read a file owned by another user either when the file is world-readable, when www-data appears in the owning group, or when an ACL grants the access.
ACL administration follows the same backup discipline as any other configuration: getfacl -R / > acls.bak records every ACL under a tree, and setfacl --restore=acls.bak replays them. To strip all ACLs and return a file to the simple Unix model, setfacl -b file suffices. Some filesystems, notably FAT32, only support the eight bits of legacy DOS attributes, so POSIX ACLs cannot be stored natively there; mount options may simulate them, but this is always a shim rather than true ACL storage. Native Linux filesystems like btrfs and XFS do support POSIX ACLs alongside extended attributes, and XFS additionally exposes DMAPI metadata.
An entirely different way to extend privilege is through POSIX capabilities. Instead of giving an entire binary setuid root, the binary can be granted just the specific capability it needs. A common example is binding to a low port: setcap cap_net_bind_service=+ep /path/binary allows the program to listen on port 80 without the wider powers of root. The granted capabilities are queried with getcap binary. Together with SELinux and AppArmor MAC policies, capabilities form the modern alternatives to setuid and ACLs for fine-grained privilege control.