ZFS ACL Inheritance: umask and canonical ACEs

[Chris Stankevitz]

On 4/12/17 11:07 AM, Chris Stankevitz wrote:
  2. How do I tell ZFS/ACL that I do not want owner@, group@, or
> everything@ ACEs created unless explicitly requested by setfacl?  I do
> not want "extra" ACEs to appear on files I create within a particular
> directory -- even these "canonical" ACEs.

https://github.com/freebsd/freebsd/blob/master/sys/kern/subr_acl_nfs4.c

 From sys/kern/subr_acl_nfsv4.c acl_nfs4_compute_inherited_acl_psarc 
(which I'm guessing is called when a file is created):

_acl_append(aclp, ACL_USER_OBJ, user_allow ...
_acl_append(aclp, ACL_GROUP_OBJ, group_allow ...
_acl_append(aclp, ACL_EVERYONE, everyone_allow ...

So it looks like I must have an @owner, @group, and @everyone at 
creation.  On Windows if you have a directory containing just one 
to-be-inherited ACE -- when you create a file within that directory, 
that new file also contains just one ACE.  Apparently on FreeBSD/ZFS you 
get some more "special" ACEs that appear whether you want them or not.

My Windows users (via Samba) are not used to these "bonus ACEs" 
appearing when they create files.

Chris