lets say we want that only user tutu can read the file

/home/grafh/file.txt 

what is the configuration that need to do in order to enable that?

• file owner must be stay as root ( and only user tutu can read the file )

You have two possibilities, using the the classical DAC (Discretionary Access Control, the usual rwx rights) of using files ACL (Access Control Lists).

Using DAC permissions

If tutu has not its own group (check groups tutu output), you must create a new group and make tutu the only member of this group.

root@host:~# addgroup tutu
root@host:~# usermod -G tutu tutu

Then change the file permissions to allow read access to the members of the tutu group:

root@host:~# chgrp tutu /home/grafh/file.txt
root@host:~# chmod 640 /home/grafh/file.txt

This file will remain owned by root, but be readable (but not writeable) by tutu and not by the other other users.

Using ACL permissions

ACLs are additional rights which come in addition to the DAC permissions seen above. There are meant to solve situation which cannot be easily solved using the historical Unix DAC permission system.

To allow tutu to read the file:

root@host:~# setfacl -m u:tutu:r /home/grafh/file.txt 

In order for this to work tutu must have execution access to /home/grafh.

root must execute these commands:

chown root:tutu /home/grafh/file.txt 
chmod 640 /home/grafh/file.txt

This works only if there is a group tutu and the user tutu is its only member.