POSIX ACLs were something even the POSIX group didn't want to publish and are horrible, horrible mess once you deal with ACLs beyond individual files. I spent

POSIX ACLs were something even the POSIX group didn't want to publish and are horrible, horrible mess once you deal with ACLs beyond individual files. I spent some... long nights writing a program that ensured ACLs were appropriately applied in complex setup and automatically inherited by new files. It supported both NFSv4/ZFS format and POSIX ACLs... the former was essentially one line per ACL, the latters involved very racy "drop all", "apply again recursively in very specific order" for every change in ACLs.