Access Control Lists for Filesystems

Oracle^® ZFS Storage Appliance Administration Guide, Release OS8.7.x

Document Information

About Oracle ZFS Storage Appliance

Oracle ZFS Storage Appliance Key Features

Supported Protocols

Appliance Data Services

Data Availability

Browser User Interface (BUI)

Network Icons

Dashboard Icons

Analytics Toolbar Icons

Identity Mapping Icons

Supported Browsers

Command Line Interface (CLI)

CLI Contexts

CLI Properties

Working with CLI Scripting

Using Batch Commands

Understanding the CLI Scripting Commands

Accessing the CLI Script Environment

Understanding the Built-in CLI Functions

Using the Run Function

Using the Get Function

Using the List Function

Using the Children Function

Using the Choices Function

Using the Functions for Generating Output

Understanding CLI Scripting Errors

Configuring the Appliance

Initial Appliance Configuration

Appliance Cluster Configuration

Cluster Configuration BUI View

Upgrading a Standalone Appliance to a Clustered Configuration (BUI)

Shutting Down a Clustered Configuration (BUI)

Shutting Down a Clustered Configuration (CLI)

Cluster Terminology

Understanding Clustering

Unconfiguring Clustering

Cluster Advantages and Disadvantages

Cluster Interconnect I/O

Cluster Resource Management

Cluster Takeover and Failback

Configuration Changes in a Clustered Environment

Clustering Considerations for Storage

Clustering Considerations for Networking

Private Local IP Interfaces

Clustering Considerations for InfiniBand

Preventing Split-Brain Conditions

Estimating and Reducing Takeover Impact

Network Configuration

Network Configuration (BUI)

Configuring Management Interfaces (BUI)

Locking Cluster Management Interfaces (BUI)

Creating a Single Port Interface (BUI)

Modifying an Interface (BUI)

Unlocking Data Interfaces (BUI)

Creating an LACP Aggregated Link Interface (BUI)

Creating an IPMP Group Using Probe-Based and Link-State Failure Detection (BUI)

Creating an IPMP Group Using Link-State Only Failure Detection (BUI)

Extending an LACP Aggregation (BUI)

Extending an IPMP Group (BUI)

Creating an InfiniBand Partition Datalink and Interface (BUI)

Creating a VNIC Without a VLAN ID for Clustered Controllers (BUI)

Creating VNICs with the Same VLAN ID for Clustered Controllers (BUI)

Adding a Static Route (BUI)

Deleting a Static Route (BUI)

Network Configuration (CLI)

Configuring Management Interfaces (CLI)

Configuring Network Interfaces (CLI)

Locking Cluster Management Interfaces (CLI)

Adding a Static Route (CLI)

Deleting a Static Route (CLI)

Unlocking Data Interfaces (CLI)

Changing the Multihoming Property to Strict (CLI)

Working with Network Configuration

Configuring Management Interfaces

Configuring Network Datalinks

Configuring Network Interfaces

Configuring Network IP MultiPathing (IPMP)

Configuring Network Performance and Availability

Configuring Network Routing

Configuring Storage

Creating a Storage Pool (BUI)

Creating a Storage Pool (CLI)

Importing an Existing Storage Pool (BUI)

Importing an Existing Storage Pool (CLI)

Configuring an All-Flash Storage Pool (BUI)

Configuring an All-Flash Storage Pool (CLI)

Adding a Disk Shelf to an Existing Storage Pool (BUI)

Adding a Disk Shelf to an Existing Storage Pool (CLI)

Adding a Cache, Meta, or Log Device to an Existing Storage Pool (BUI)

Adding a Cache, Meta, or Log Device to an Existing Storage Pool (CLI)

Removing a Cache or Log Device from an Existing Storage Pool (BUI)

Removing a Cache or Log Device from an Existing Storage Pool (CLI)

Unconfiguring a Storage Pool (BUI)

Unconfiguring a Storage Pool (CLI)

Renaming a Storage Pool (BUI)

Renaming a Storage Pool (CLI)

Scrubbing a Storage Pool (BUI)

Scrubbing a Storage Pool (CLI)

Viewing Pool and Device Status (BUI)

Storage Pool Concepts

Storage Pool Configuration

Multiple Pools

Number of Devices per Pool

Drive Characteristics and Performance

Storage Pool Capacity

All-Flash Storage Configuration

Storage Pool Reclaimed Space

Data Profiles for Storage Pools

Understanding the Appliance Status

Summary of Pool Usage

Summary of Memory Usage

Disk Activity Dashboard

Dashboard CLI

Running the Dashboard Continuously

Status Dashboard Settings

Changing the Displayed Activity Statistics

Changing the Activity Thresholds

NDMP Status

NDMP States

Configuring Storage Area Network (SAN)

Configuring FC Port Modes (BUI)

Discovering FC Ports (BUI)

Creating FC Initiator Groups (BUI)

Associating a LUN with an FC Initiator Group (BUI)

Changing FC Port Modes (CLI)

Discovering FC Ports (CLI)

Creating FC Initiator Groups (CLI)

Associating a LUN with an FC Initiator Group (CLI)

Scripting Aliases for Initiators and Initiator Groups (CLI)

Creating an Analytics Worksheet (BUI)

Configuring SAN iSER Targets

Adding an iSCSI Target with an Auto-generated IQN (CLI)

Adding an iSCSI Target with a Specific IQN and RADIUS Authentication (CLI)

Adding an iSCSI Initiator with CHAP Authentication (CLI)

Adding an iSCSI Target Group (CLI)

Adding an iSCSI Initiator Group (CLI)

Configuring SRP Target (BUI)

Configuring SRP Targets (CLI)

Understanding SAN

SAN Fibre Channel Configuration

SAN iSCSI Configuration

SAN iSCSI Initiator Configuration

SAN SRP Configuration

SAN Terminology

Configuring Users

Adding an Administrator or User (BUI)

Adding an Administrator or User (CLI)

Changing a User Password (BUI)

Changing a User Password (CLI)

Editing Exceptions for a User (BUI)

Editing Exceptions for a User (CLI)

Deleting Exceptions for a User (BUI)

Deleting Exceptions for a User (CLI)

Adding a Role (BUI)

Adding a Role (CLI)

Editing Authorizations for a Role (BUI)

Editing Authorizations for a Role (CLI)

Deleting Authorizations from a Role (BUI)

Deleting Authorizations from a Role (CLI)

Adding a User Who Can View the Dashboard

Viewing the Logged-in User

Understanding Users and Roles

User Authorizations

Managing User Properties

Setting Appliance Preferences

Setting Preferences (BUI)

Setting Preferences (CLI)

Setting SSH Public Keys (BUI)

Setting SSH Public Keys (CLI)

Preference Properties

Configuring Alerts

Adding an Alert Action (BUI)

Adding an Alert Action (CLI)

Sending Email Alerts (CLI)

Sending an SNMP Trap (CLI)

Alert Categories

Sending Syslog Messages

Executing a Workflow

Threshold Alerts

Resuming/Suspending Analytics Datasets and Worksheets

Configuring Certificates

Creating a New Server Certificate (BUI)

Creating a New Server Certificate (CLI)

Uploading CA Certificates from Non-root CAs (BUI)

Uploading CA Certificates from Non-root CAs (CLI)

Viewing CSR and Certificate Details (BUI)

Viewing CSR and Certificate Details (CLI)

Destroying a CSR or Certificate (BUI)

Destroying a CSR or Certificate (CLI)

Setting the Appliance Certificate (BUI)

Setting the Appliance Certificate (CLI)

Uploading Trusted Certificates (BUI)

Uploading Trusted Certificates (CLI)

Viewing Trusted Certificate Details (BUI)

Viewing Trusted Certificate Details (CLI)

Destroying a Trusted Certificate (BUI)

Destroying a Trusted Certificate (CLI)

Assigning a Certificate to a Service (BUI)

Assigning a Certificate to a Service (CLI)

HTTP Strict Transport Security

Enabling HTTP Strict Transport Security (BUI)

Enabling HTTP Strict Transport Security (CLI)

Configuring SSL/TLS Versions and Ciphers

Configuring SSL/TLS (BUI)

Configuring SSL/TLS (CLI)

Appliance Services

Managing Services

Viewing a Service in the BUI

Selecting a Service in the CLI

Enabling a Service (BUI)

Enabling a Service (CLI)

Disabling a Service (BUI)

Disabling a Service (CLI)

Viewing Service States in the CLI

Viewing Service Help in the CLI

Setting Service Properties (BUI)

Setting Service Properties (CLI)

Viewing Service Logs (BUI)

Viewing Service Logs (CLI)

List of Available Appliance Services

Required Service Ports

Configuring Services

Active Directory Configuration

Joining an AD Domain (BUI)

Joining an AD Workgroup (BUI)

Configuring Active Directory (CLI)

Active Directory Join Domain

Active Directory Domains and Workgroups

Active Directory LDAP Signing

Active Directory Windows Server Support

DNS Configuration

Configuring DNS (BUI)

Configuring DNS (CLI)

Testing Hostname Resolution (CLI)

Adding a DNS Server (BUI)

Adding a DNS Server (CLI)

Viewing DNS Server Status (BUI)

Viewing DNS Server Status (CLI)

DNS Properties and Logs

Active Directory and DNS

Non-DNS Resolution

DNS-Less Operation

Dynamic Routing Configuration

FTP Configuration

Adding FTP Access to a Share (BUI)

FTP Properties

FTP Logs

HTTP Configuration

Adding HTTP Access to a Share (BUI)

HTTP Properties and Logs

HTTP Logs

See Also

HTTP Authentication and Access Control

Object Store Configuration

HTTPS Configuration

HTTPS Properties and Logs

Identity Mapping Configuration

Configuring Identity Mapping (BUI)

Configuring Identity Mapping (CLI)

Creating a Mapping Rule (BUI)

Creating a Mapping Rule (CLI)

Viewing a Mapping (BUI)

Flushing Mappings from the Cache (BUI)

Flushing Mappings from the Cache (CLI)

Identity Mapping Best Practices

Identity Mapping Concepts

Cached and Ephemeral Mappings

Identity Mapping Case Sensitivity

Mapping Rule Directional Symbols

IPMP Configuration

iSCSI Configuration

Kerberos Configuration

Creating a Kerberos Realm (BUI)

Creating a Kerberos Realm (CLI)

Importing Kerberos Keys (BUI)

Importing Kerberos Keys (CLI)

Creating Kerberos Principals and Keys (BUI)

Creating Kerberos Principals and Keys (CLI)

Deleting Kerberos Principals and Keys (BUI)

Deleting Kerberos Principals and Keys (CLI)

Destroying a Kerberos Realm (BUI)

Destroying a Kerberos Realm (CLI)

Kerberos Service Properties

Kerberos Properties and Logs

LDAP Configuration

Adding an Appliance Administrator (BUI)

Setting Properties with Multiple Attribute Value Pairs (CLI)

Configuring LDAP Security Settings (BUI)

Configuring LDAP Security Settings (CLI)

Monitoring LDAP Server Status (BUI)

Monitoring LDAP Server Status (CLI)

LDAP Properties

LDAP Custom Mappings

NDMP Configuration

NDMP Local vs. Remote Configurations

NDMP Backup Formats and Types

NDMP Backup with Types dump and tar

NDMP Backup with Type zfs

NDMP Incremental Backups

Replica Backups

Enabling Replica Backups

Replica Backup Syntax

Replica Backup Persistent Holds

Incremental Replica Backups

NDMP Properties and Logs

NFS Configuration

NFS Service Properties

Configuring Kerberos Realms for NFS

NFS Logs and Analytics

NFS Properties

NFS Naming Service Dependencies

Sharing a Filesystem Over NFS

NIS Configuration

Adding an Appliance Administrator from NIS (BUI)

NIS Properties and Logs

NTP Configuration

Setting Clock Synchronization (BUI)

Configuring NTP (CLI)

NTP Properties

Phone Home Configuration

Registering the Appliance (BUI)

Registering the Appliance (CLI)

Changing Account Information (BUI)

Phone Home Properties

RESTful API Configuration

Service Tags Configuration

SFTP Configuration

Adding SFTP Access to a Share (BUI)

Configuring SFTP for Remote Access (CLI)

SFTP Properties, Ports, and Logs

Shadow Migration Configuration

SMB Configuration

SMB Service Properties

Setting Properties to Export Shares over SMB

NFS/SMB Interoperability

SMB DFS Namespaces

SMB Microsoft Stand-alone DFS Namespace Management Tools Support Matrix

Adding DFS Namespaces to a Local SMB Group

SMB Autohome

Adding SMB Autohome Rules (CLI)

Adding a User to an SMB Local Group

SMB MMC Integration

SMB Share Management

SMB Users, Groups, and Connections

Listing SMB Services

Configuring SMB (BUI)

Configuring SMB Active Directory (BUI)

Configuring SMB Project and Share (BUI)

Configuring SMB Data Service (BUI)

SMTP Configuration

SNMP Configuration

Configuring SNMP to Serve Appliance Status (BUI)

Configuring SNMP to Send Traps (BUI)

Disabling root SSH Access (CLI)

SSH Properties and Logs

Syslog Configuration

Classic Syslog: RFC 3164

Updated Syslog: RFC 5424

SYSLOG Message Format

SYSLOG Alert Message Format

Example Configuring an Oracle Solaris Receiver (CLI)

Example Configuring a Linux Receiver (CLI)

System Identity Configuration

System Identity Properties and Logs

TFTP Configuration

Adding TFTP Access to a Share (BUI)

Virus Scan Configuration

Configuring Virus Scanning for a Share (BUI)

Virus Scan Properties and Logs

Virus Scan File Extensions

Scanning Engines

Shares and Projects

Creating a Project (BUI)

Creating a Project (CLI)

Editing a Project (BUI)

Editing a Project (CLI)

Renaming a Project (BUI)

Renaming a Project (CLI)

Deleting a Project (BUI)

Deleting a Project (CLI)

Creating a Filesystem or LUN in a Project (BUI)

Creating a Filesystem or LUN in a Project (CLI)

Editing a Filesystem or LUN (BUI)

Editing a Filesystem or LUN (CLI)

Renaming a Filesystem or LUN (BUI)

Renaming a Filesystem or LUN (CLI)

Moving a Filesystem or LUN to a Different Project (BUI)

Moving a Filesystem or LUN to a Different Project (CLI)

Deleting a Filesystem or LUN (BUI)

Deleting a Filesystem or LUN (CLI)

Setting User or Group Quotas (BUI)

Setting User or Group Quotas (CLI)

About Storage Pools, Projects, and Shares

Project and Share Properties

Inherited Properties

Mountpoint

Read only

Update access time on read

Non-blocking mandatory locking

Synchronous write bias

Database record size

Additional replication

Virus scan

Prevent destruction

Restrict ownership change

Data Migration Source

Project Properties

Filesystem Properties

LUN Properties

Space Management for Shares

Shares Terminology

Managing Filesystem and Project Space

Setting User or Group Quotas

Working with Identity Management

Working with Filesystem Namespace

Share Usage Statistics

Share and Project Protocols

NFS Protocol

NFS Protocol Properties

NFS Share Mode Exceptions

Managing Netgroups

NFS Share Modes and Exception Options

NFS Protocol Character Set Encodings

NFS Protocol Security Modes

SMB Protocol

SMB Protocol Properties

Client-side Caching Property

Opportunistic Locks Property

SMB Protocol Share Mode Exceptions

Access Control Lists for Filesystems

Root Directory Access

ACL Behavior on Mode Change

ACL Inheritance Behavior

Root Directory ACL

Working with Schemas

Creating a Schema (BUI)

Creating a Schema (CLI)

Schema Properties

Shadow Migration

Understanding Shadow Migration

Creating a Shadow Filesystem

Managing Background Migration

Handling Migration Errors

Monitoring Migration Progress

Monitoring Migration Progress and Errors (BUI)

Monitoring Migration Progress and Errors (CLI)

Canceling Migration

Snapshotting Shadow File Systems

Backing Up Shadow File Systems

Replicating Shadow File Systems

Migrating Local File Systems

Using Shadow Migration Analytics

Testing Potential Shadow Migration using the CLI

Migrating Data from an Active NFS Server using the CLI

Snapshots and Clones

Snapshot Space Management

Taking a Snapshot (BUI)

Taking a Snapshot (CLI)

Scheduling Snapshots (BUI)

Scheduling Snapshots (CLI)

Setting a Scheduled Snapshot Label (BUI)

Setting a Scheduled Snapshot Label (CLI)

Viewing Snapshots and Schedules (BUI)

Viewing Snapshots and Schedules (CLI)

Editing a Snapshot Retention Policy (BUI)

Editing a Snapshot Retention Policy (CLI)

Removing a Snapshot Schedule (BUI)

Removing a Snapshot Schedule (CLI)

Making a Filesystem Snapshot Directory Visible (BUI)

Making a Filesystem Snapshot Directory Visible (CLI)

Accessing a Hidden Filesystem Snapshot Directory (CLI)

Accessing a Visible Filesystem Snapshot Directory (CLI)

Renaming a Snapshot (BUI)

Renaming a Snapshot (CLI)

Rolling Back to a Snapshot (BUI)

Rolling Back to a Snapshot (CLI)

Destroying a Snapshot (BUI)

Destroying a Snapshot (CLI)

Cloning a Snapshot (BUI)

Cloning a Snapshot (CLI)

Cloning a Clone

Viewing Clones of a Snapshot (BUI)

Viewing Clones of a Snapshot (CLI)

Viewing a Clone Origin (BUI)

Viewing a Clone Origin (CLI)

Remote Replication

Remote Replication Workflow

Configuring Remote Replication

Checking Source and Target Compatibility

Setting Up Network Interfaces and Static Routing (BUI)

Setting Up Network Interfaces and Static Routing (CLI)

Creating a Replication Target (BUI)

Creating a Replication Target (CLI)

Creating a Replication Action (BUI)

Creating a Replication Action (CLI)

Configuring Automatic Snapshot Retention on a Target (BUI)

Configuring Automatic Snapshot Retention on a Target (CLI)

Manually Sending a Replication Update (BUI)

Manually Sending a Replication Update (CLI)

Configuring Replication for a Clustered Configuration

Configuring Offline Replication (BUI)

Setting Up an NFS Server for Offline Replication

Setting Up an Export Path to the NFS Server (BUI)

Exporting a Replication Update (BUI)

Verifying the Replication Stream On the NFS Server

Importing the Replication Stream from the NFS Server (BUI)

Performing a Manual Network Update (BUI)

Reversing an Offline Replication (BUI)

Configuring Offline Replication (CLI)

Setting Up an NFS Server for Offline Replication

Setting Up an Export Path to the NFS Server (CLI)

Exporting a Replication Update (CLI)

Verifying a Replication Stream On the NFS Server

Importing a Replication Stream from the NFS Server (CLI)

Performing a Manual Network Update (CLI)

Reversing an Offline Replication (CLI)

Disabling Replication Compression (BUI)

Disabling Replication Compression (CLI)

Editing a Replication Target (BUI)

Editing a Replication Target (CLI)

Editing a Replication Action (BUI)

Editing a Replication Action (CLI)

Monitoring Remote Replication

Monitoring Replication Progress (BUI)

Monitoring Replication Progress (CLI)

Setting Replication Alerts

Replication Audit Actions

Monitoring Replication Delays and RPO (BUI)

Monitoring Replication Delays and RPO (CLI)

Using Replication Analytics

Managing Replication Packages

Managing User-Generated Snapshots

Canceling a Replication Update (BUI)

Canceling a Replication Update (CLI)

Cloning a Replication Package (BUI)

Cloning a Replication Package (CLI)

Cloning a Snapshot in a Replication Package (BUI)

Cloning a Snapshot in a Replication Package (CLI)

Severing a Replication Package (BUI)

Severing a Replication Package (CLI)

Editing a Replication Package (BUI)

Editing a Replication Package (CLI)

Disabling a Replication Package (BUI)

Disabling a Replication Package (CLI)

Disaster Recovery with Remote Replication

Setting Up a Replication Target at a Recovery Site (BUI)

Switching Operations to the Recovery Site (BUI)

Updating the Production Site (BUI)

Reversing Replication Back to the Production Site (BUI)

Setting Up a Replication Target at a Recovery Site (CLI)

Switching Operations to the Recovery Site (CLI)

Updating the Production Site (CLI)

Reversing Replication Back to the Production Site (CLI)

Remote Replication Concepts

Replication Terminology

Replication Targets

Replication Actions and Packages

Replication Update Frequency

Replication Action and Package Relationship

Replication Action Properties

Replication Package Properties

Replication Storage Pools

Project vs. Share Replication

Replication Authorizations

Deduplicated Replication

Deduplicated Replication Statistics

Measuring Deduplicated Replication Statistics

Single Deduplicated Replication Update Benefits Comparison

Averaged Deduplicated Replications Updates Benefits Comparison

Replication Configuration for Clustered Appliances

Example: Replication Configuration for Clustered Appliances

Configuration Guidelines

Example: Configuring Replication for Clustered Appliances

Replication Data Path Illustrated Examples

Replication Snapshots and Data Consistency

Replication Snapshot Management

Intermediate Replication Snapshots

Replication Automatic Snapshot Management

iSCSI Configurations and Replication

Resumable Replication

Replication Alerts

Send Finish Alerts

Replication Failures

Compressed Replication

Replication Packages

Cloning a Replication Package or Share

Exporting Replicated Filesystems

Severing Replication

Reverse the Direction of Replication

Reversing Replication for Disaster Recovery

Share-level and Project-level Reversal

Destroying a Replication Package

Target Replica Backups

Data Encryption

Data Encryption Workflow

Configuring LOCAL Keystore Encryption (BUI)

Configuring LOCAL Keystore Encryption (CLI)

Configuring OKM Keystore Encryption (BUI)

Configuring OKM Keystore Encryption (CLI)

Creating an Encrypted Project (BUI)

Creating an Encrypted Project (CLI)

Changing a Project Encryption Key (BUI)

Changing a Project Encryption Key (CLI)

Creating an Encrypted Filesystem or LUN (BUI)

Creating an Encrypted Filesystem or LUN (CLI)

Changing a Share Encryption Key (BUI)

Changing a Share Encryption Key (CLI)

Backing Up a LOCAL Key (BUI)

Backing Up a LOCAL Key (CLI)

Deleting an Encryption Key (BUI)

Deleting an Encryption Key (CLI)

Restoring a LOCAL Key (BUI)

Restoring a LOCAL Key (CLI)

Encryption Properties

Managing Encryption Keys

Maintaining Keys

Understanding Encryption Key Values

Performance Impact of Encryption

Encryption Key Life Cycle

Backing up and Restoring Encrypted Data

Replicating an Encrypted Share

Maintenance Workflows

Understanding Workflows

Understanding Workflow Parameters

Constrained Workflow Parameters

Optional Workflow Parameters

Workflow Error Handling

Workflow Input Validation

Workflow Execution Auditing and Reporting

Understanding Workflow Versioning

Using Workflows for Alert Actions

Using Scheduled Workflows

Using a Scheduled Workflow

Coding Workflow Schedules

Creating a Worksheet Based on a Specified Drive Type

Uploading and Executing Workflows Using the BUI

Downloading Workflows using the CLI

Listing Workflows using the CLI

Executing Workflows using the CLI

Auditing Workflows using the CLI

Integration

Configuring Oracle ZFS Storage Appliance for Oracle Database Clients

Plug-ins for Oracle Products

Oracle Enterprise Manager Plug-in for Oracle ZFS Storage Appliance

Oracle VM Storage Connect Plug-in for Oracle ZFS Storage Appliance

Oracle ZFS Storage Appliance Network File System Plug-in for Oracle Solaris Cluster

Oracle ZFS Storage Appliance Plug-in for Oracle Solaris Cluster Geographic Edition

Plug-ins for Non-Oracle Products

Oracle ZFS Storage Appliance Virtual Storage Manager Plug-ins for VMware vSphere and VMware vSphere Web Client

Oracle ZFS Storage Appliance Storage Replication Adapter for VMware Site Recovery Manager

Oracle ZFS Storage Appliance Plug-in for VMware vSphere Storage APIs for Array Integration – NAS

Oracle ZFS Storage Appliance Provider for VMware vSphere APIs for Storage Awareness

Oracle ZFS Storage Appliance Provider for Volume Shadow Copy Service Software

Oracle ZFS Storage Appliance Plug-in for Veritas NetBackup OpenStorage

Oracle ZFS Storage Appliance Plug-in for CommVault Simpana IntelliSnap

Oracle Intelligent Storage Protocol

Database Record Size

Synchronous Write Bias Hint

Analytics Breakdown by Database Name

Caching Hints

OISP-Capable Protocols and Clients

Fibre Channel and iSCSI Support with Veritas Dynamic Multi-Pathing and Storage Foundation/InfoScale Foundation

Language:

You can set options to control ACL behavior as well as control access to the root directory of the filesystem.

Note - ACLs are available only for filesystems.

For more information about ACLs, see the following topics:

Root Directory Access
ACL Behavior on Mode Change
ACL Inheritance Behavior
Root Directory ACL