An ACL (access control list) grants permissions to extra users and groups beyond the classic owner, group, and other bits. getfacl prints the base mode plus every named user and group entry, and -R walks all subdirectories. Look for the mask line, which caps what the named entries can receive.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.