Is there an alternative to setfacl in FreeBSD to use nfsv4 acl?

Question

FreeBSD

Good day!
There is a network sphere on samba4. The task is to set the rights so that the owner of the folder can do anything in it, and the users of the group can only view the existing information and add new information (create new directories and files), without the right to change or delete the existing ones. The network folder is located on the zfs file system with the following inheritance options:
aclmode=passthrough, aclinherit=passthrough
What is now: we set the rights to 770 on the user's directory. We go in samba - everything is visible, we can record and delete any user from the group. We add the necessary rights with the serfacl command. As before, everything works as if we did not add any rights. Create a new folder (it doesn't matter - through the console or samba). According to the FS rules, only those rights that we set with the setfacl command are inherited on the folder. The newly created folder has the rights that we need, i.e. Users in the group can add information, but cannot change or delete existing information. Now the most interesting. These are the permissions set by the chmod+setfacl command:

ls -l ./
drwxr-x---+ 6 LENCOR\test staff 6 15 янв 18:19 test
getfacl test/
# file: test/
# owner: LENCOR\test
# group: staff
[email protected]:rwxpDdaARWcCos:fdi---:allow
[email protected]:----Dd-A-W-Cos:fdi---:deny
[email protected]:rwxp--a-R-c---:fdi---:allow
[email protected]:------a-R-c---:fdi---:allow
[email protected]:rwxp--aARWcCos:------:allow
[email protected]:r-x---a-R-c--s:------:allow
[email protected]:------a-R-c--s:------:allow

These are the permissions that were automatically inherited to the subdirectory when it was created (where everything works as it should):

ls -l test/
drwxrwx---+ 2 LENCOR\test staff 2 15 янв 18:19 222
getfacl test/222/
# file: test/222/
# owner: LENCOR\test
# group: staff
[email protected]:rwxpDdaARWcCos:fd----:allow
[email protected]:----Dd-A-W-Cos:fdi---:deny
[email protected]:rwxp--a-R-c---:fd----:allow
everyo[email protected]:------a-R-c---:fd----:allow

If I try to set access rights with commands, as in the second option, removing unnecessary rights with the setfack -x4 (5, 6) command, then the following happens:

ls -l ./
d---------+ 2 LENCOR\test staff 2 15 янв 18:19 test
getfacl test/
# file: test/
# owner: LENCOR\test
# group: staff
[email protected]:rwxpDdaARWcCos:fd----:allow
[email protected]:----Dd-A-W-Cos:fdi---:deny
[email protected]:rwxp--a-R-c---:fd----:allow
[email protected]:------a-R-c---:fd----:allow

When resetting all rights with the setfacl -b command and applying only the required four, the result is the same. In this case, even the owner cannot get into the directory.
Question: how to correctly set access rights, as in the second option, and where could I screw up? Perhaps there is some detailed mana for installing NFSv4ACL on a fryer? (do not offer man setfacl and handbook - there is not much written on this topic) Are there alternatives to the setfacl utility?

Answer 1

Figured it out myself. Permissions set by setfacl are correctly translated to ls -l unless the "inherit_only" flag has been set. Those. my policies should look NOT like:

[email protected]:rwxpDdaARWcCos:fdi---:allow
[email protected]:----Dd-A-W-Cos:fdi---:deny
[email protected]:rwxp--a-R-c---:fdi---:allow
[email protected]:------a-R-c---:fdi---:allow

BUT:

[email protected]:rwxpDdaARWcCos:fd----:allow
[email protected]:----Dd-A-W-Cos:fd----:deny
[email protected]:rwxp--a-R-c---:fd----:allow
[email protected]:------a-R-c---:fd----:allow

In this form, everything works correctly.