The output format of getfacl is as follows:
1: # file: somedir/
2: # owner: lisa
3: # group: staff
5: user:joe:rwx #effective:r-x
6: group::rwx #effective:r-x
11: default:user:joe:rwx #effective:r-x
Lines 4, 6 and 9 correspond to the user, group and other fields of the
file mode permission bits. These three are called the base ACL entries.
Lines 5 and 7 are named user and named group entries. Line 8 is the
effective rights mask. This entry limits the effective rights granted
to all groups and to named users. (The file owner and others permis-
sions are not affected by the effective rights mask; all other entries
are.) Lines 10--14 display the default ACL associated with this direc-
tory. Directories may have a default ACL. Regular files never have a
The fact that yours shows lines only with
:: and not
<user|group|other>:<name>:<perms> indicates that you have no extended ACLs. For this particular file, you are just using
getfacl as a fancy way of obtaining the same info as would show in
ls -la (the user/group/other permission bits aka the "base ACL".)
As for which permissions are used: the short answer is it depends on the order of the ACLs. See here and here for details. In general, if a deny comes first in the ACL list, it is impossible to later on give the permission back with an explicit allow. Denies always take precedence.
There's an even longer article with more references here on Unix.SE.