illumos gate

There is a bug regarding inheritance of "deny" entries. It seems their permissions are masked according to umask, just like for "allow" type entries, which means "stricter" umask results in "looser" permissions. Patch (unfortunately from FreeBSD Perforce, so it needs to be applied by hand) attached below:

==== //depot/user/pjd/zfs/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_acl.c#42 (text) ====

@@ -1467,7 +1467,7 @@
                         * Limit permissions to be no greater than
                         * group permissions
                         */
-                       if (zfsvfs->z_acl_inherit == ZFS_ACL_RESTRICTED) {
+                       if (type == ALLOW && zfsvfs->z_acl_inherit == ZFS_ACL_RESTRICTED) {
                                if (!(mode & S_IRGRP))
                                        access_mask &= ~ACE_READ_DATA;
                                if (!(mode & S_IWGRP))