Setup ACL on a file or folder

setfacl -m user:username:rwx,mask:rwx /path/to/file

Only root can read write /boot/grub2/grub.cfg
setfacl -m other::- grub.cfg