The d ZFS ACL is suppose to give or deny permission to delete a file. It have no effect.

The below is the output from the script in "How to repeat the problem", and please notice:

* Eventhough www doesn't have delete permission and there is an explicit deny, rm was possible.



p="/tank/project1"
f="$p/test2"
u="user1"

rm -f $f
setfacl -b $p

setfacl -m group@::fd:allow $p || exit 1
setfacl -m everyone@::fd:allow $p || exit 1
setfacl -m owner@:rwx:fd:allow $p || exit 1
setfacl -m u:$u:full_set:fd:allow $p || exit 1

setfacl -m u:www:rwxa:fd:allow $p || exit 1
setfacl -m u:www:d:fd:deny $p || exit 1
getfacl $p
# file: /tank/project1
# owner: root
# group: wheel
          user:www:-----d--------:fd----:deny
          user:www:rwx---a-------:fd----:allow
        user:user1:rwxpDdaARWcCos:fd----:allow
            owner@:rwx-----------:fd----:allow
            group@:--------------:fd----:allow
         everyone@:--------------:fd----:allow

su -m $u -c "touch $f"
getfacl $f
# file: /tank/project1/test2
# owner: user1
# group: wheel
          user:www:-----d--------:------:deny
          user:www:rw----a-------:------:allow
        user:user1:rw-pDdaARWcCos:------:allow
            owner@:rw------------:------:allow
            group@:--------------:------:allow
         everyone@:--------------:------:allow

su -m www -c "ls -l $f"
ls: /tank/project1/test2: Permission denied
-rw-------  1 user1  wheel  0 Dec 19 14:23 /tank/project1/test2

su -m www -c "rm $f"
ls -l $f
ls: /tank/project1/test2: No such file or directory

How-To-Repeat: p="/tank/project1"
f="$p/test2"
u="user1"

rm -f $f
setfacl -b $p

setfacl -m group@::fd:allow $p || exit 1
setfacl -m everyone@::fd:allow $p || exit 1
setfacl -m owner@:rwx:fd:allow $p || exit 1
setfacl -m u:$u:full_set:fd:allow $p || exit 1

setfacl -m u:www:rwxa:fd:allow $p || exit 1
setfacl -m u:www:d:fd:deny $p || exit 1
getfacl $p

su -m $u -c "touch $f"
getfacl $f

su -m www -c "ls -l $f"

su -m www -c "rm $f"
ls -l $f