Suppose the following sequence of file ACE settings (and corresponding POSIX mode bits) for user u1.
User u1 is granted permissions to read a file, sampleFile.
After the command runs, user u1 has permissions to (only) read the file and the POSIX mode bit for reading the file is set to u1 for owner/users.
There is no change in ACEs or POSIX mode bits for all other (write and execute) access types.
User u1 is granted permissions to write to the same file.
After the command runs, user u1 has permissions to write and the POSIX mode bit for writing to the file is set to u1 for owner/users.
There is no change in ACEs or POSIX mode bits for all other (read and execute) access types.
User u1's permissions are modified to remove write permission (using the empty string) and to grant access to execute file.
Writing to the file is set to 0 for owner/users, groups, and others.
Executing the file is set to u1 for owner/users.
Note: When the empty string ("") is used to deny a specific type of file access, that type of file access is denied to all users, groups, and roles. To deny access to specific users only, use the negation operator (!).
There is no change in ACEs or POSIX mode bits for all other (read) access types.