A little difficult: how to replicate the posix acl default on zfs/nfsv4 acl?

Question

Suppose I want a dir, which all files and directories created inside has the group permission of the group owner of the dir, and 770 as default permission. With posix ACL is really easy

#create a dir..
mkdir proof

#inherit group permission "video" in this example
chmod g+s proof/
chgrp video proof/

#with setfacl make the default group with rxw permissions
setfacl -d -m g:video:rwx proof

#other are not allowed
setfacl -d -m o:--- proof/
chmod o-x proof

#give the acl
setfacl -m g:video:rwx proof

Now I create a file and a dir inside the dir proof..

mkdir try1
drwxrws---+ 2 myuser video 4,0K feb 23 01:26 try1
touch file1
-rw-rw----+ 1 myuser video    0 feb 23 01:29 file1

As you can see I obtain what I want, all files in the dir inherit permissions and has the group "video" as group owner. This is possible on Linux (posix acl on ext4, btrfs, etc..) and Solaris (ufs).

Now the question..how to do this with zfs which use nfsv4 acl on Solaris? I have tried this making another dir "proof" in a zfs Solaris 11 host (of course chmod g+s was made)

chmod A=owner@:read_attributes/read_data/execute/list_directory/read_data/write_data/append_data/execute/add_file/add_subdirectory:fd:allow,group:video:read_attributes/read_data/execute/list_directory/read_data/write_data/append_data/execute/add_file/add_subdirectory:fd:allow,everyone@:read_attributes/read_data/execute/list_directory/read_data/write_data/append_data/execute/add_file/add_subdirectory:fd:deny proof

but the result is..

mkdir newdir
drwxr-sr-x+ 2 myuser video 2 23 feb 02.33 newdir

:|

How to obtain the same of posix acl? Thanks

Answer 1

Solution found, I want 770 for user+groupvideo

a)create the zfs volume

zfs create proof1

b)very important otherwise don't work!

zfs set aclinherit=passthrough rpool/proof1

c)now the acl

chmod g+s /proof1
chgrp video /proof1

#this if you don't share the dir via nfs
chmod A=owner@:full_set:fd:allow,group:video:full_set:fd:allow,everyone@:full_set:fd:deny /proof1

#this if you want to share it via nfs
chmod A=owner@:full_set:fd:allow,group:video:full_set:fd:allow,everyone@:read_set:allow /proof1

fd mean file and dir inherit

d)I create the files... and dir

mkdir dir1 
touch file1

drwxrws---+ 2 root video 2 23 feb 02.59 dir1
-rwxrwx---+ 1 root video 0 23 feb 02.59 file1

Perfect. I test it via local file, and only users which belong to video group can write on dir.