Allow ACL for regular folders and files

Feature Requests
1

Problem/Justification
I have structure like this: Dockhand dataset - stacks - local - app - postgres_data

Just the top dataset is ZFS dataset. Everything inside are regular folders managed by dockhand.
I would like to allow user 999 access to postgres_data.

I tries setting 999:999 via chown. But this gets reset by ACL because my main Dockhand dataset has owner/group set to apps and enabled inheritance.

I tried to disable inheritance in Dockhand dataset ACL editor, but this removes chmod of all files and folders inside, making it unusable.

I could add 999 user to the whole dataset in ACL editor, but I would like to only target the postgres_data folder. Principle of least privilege, yknow.

Making every folder along the way (stacks, local, app) its own ZFS dataset to get to postgres_data doesnt make sense.

Moving the postgres_data folder to some near top level dataset is possible but it would destroy this logical folder structure which I would like to keep if possible.

So I believe being able to set ACL for regular folders and files would solve this.

Impact
If user needs to set specific rights to some regular folder inside their dataset, they could just set rights for that folder. They woulnt have to set rights for whole dataset.

User Story
User would could access ACL editor for any folder or file via file browser or directly entering filepath and set the ACL rights as needed.

2

you can already set ACL on a normal directory with setfacl without making it a dataset. from a shell as root:
setfacl -m u:999:rwx /mnt/pool/Dockhand/stacks/local/app/postgres_data
setfacl -d -m u:999:rwx /mnt/pool/Dockhand/stacks/local/app/postgres_data
the -d line is the default ACL so new files inherit. inherited ACL from the parent dataset can still stomp chown, yeah, but an explicit ACL entry on that folder usually sticks even when the dataset owner is apps. if a recursive apply from the parent keeps wiping it, strip that path first with setfacl -b then re-add only what you need. GUI ACL editor only targets datasets today, so CLI is the path until/unless the feature lands.

3

Wrong tool. Starting in 26 use truenas_getfacl / truenas_setfacl. setfacl by itself is POSIX1E-only and gives misleading picture. UI ACL editor will also target filesystem paths selected for SMB shares. API targets whatever you want it to target.

4

Well, I tried for example on test folder, but I got:
setfacl: test: Operation not supported

I guess i can only wait for 26 and then try truenas_setfacl

For now I just added the user for whole dataset in UI.

Btw, I noticed that in ACL UI I can only add users, not UID/GID. This can be problem if I just need to add UID/GID to allow user inside container, but without creating user on host.