On FreeBSD 10, with ZFS, doing: touch fred ; setfacl -m user:www:full_set::deny fred ; getfacl fred ; chmod g=u fred ; getfacl fred does not work the way I expect: to be precise, the chmod causes the user:www ACE to go away. This does not happen with posix1e ACLs. I'm not sure if this is a ZFS issue, or a nfs4 acl issue. wibblewobble? Sean.