--- /dev/null	Mon Aug  5 17:20:10 2019
+++ new/usr/src/test/nfsv4-tests/tests/acl/srv_tests/acl_pos02.tcl	Mon Aug  5 17:20:10 2019
@@ -0,0 +1,384 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+
+#
+# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# NFSv4 ACL attributes:
+#
+# a: Test removing file group read perms - expect OK
+# b: Test restoring file group read perms - expect OK
+# c: Test removing file group write perms - expect OK
+# d: Test restoring file group write perms - expect OK
+# e: Test removing file group execute perms - expect OK
+# f: Test restoring file group execute perms - expect OK
+# g: Test removing all file group perms - expect OK
+# h: Test restoring all file group perms - expect OK
+#
+
+set TESTROOT $env(TESTROOT)
+
+# include common code and init section
+source [file join ${TESTROOT} tcl.init]
+source [file join ${TESTROOT} testproc]
+source [file join ${TESTROOT} acltools]
+
+# connect to the test server
+Connect
+
+# setting local variables
+set TNAME $argv0
+set expcode "OK"
+
+set POSIX_READ_ACL $env(POSIX_READ_ACL)
+set POSIX_WRITE_ACL $env(POSIX_WRITE_ACL)
+set POSIX_EXECUTE_ACL $env(POSIX_EXECUTE_ACL)
+set GENERIC_ALLOW_ACL $env(GENERIC_ALLOW_ACL)
+set GENERIC_DENY_ACL $env(GENERIC_DENY_ACL)
+
+# Get handle for base directory
+set bfh [get_fh "$BASEDIRS"]
+
+# Set params relating to test file
+set tfile "newfile.[pid]"
+set fpath [file join ${BASEDIR} ${tfile}]
+
+# Create the test file with all perms set (-rwxrwxrwx) and get its handle.
+set tfh "[creatv4_file $fpath 777]"
+if {$tfh == $NULL} {
+        putmsg stdout 0 "$TNAME: test setup"
+        putmsg stderr 0 "\t Test UNRESOLVED: failed to create tmp file=($tfile)"
+        putmsg stderr 0 "\t\t status=($status)."
+        Disconnect
+        exit $UNRESOLVED
+}
+
+
+
+# Start testing
+# ------------------------------------------------------------------------
+# a: Test removing group read file perms - expect OK
+
+set tag "$TNAME{a}"
+set ASSERTION "Test removing group read file perms  - expect $expcode"
+putmsg stdout 0 "$tag: $ASSERTION"
+
+set sid {0 0}
+
+set group_allow_mask [ aclmask [ concat $GENERIC_ALLOW_ACL $POSIX_WRITE_ACL $POSIX_EXECUTE_ACL ] ] 
+
+set group_deny_mask [ aclmask [ concat $GENERIC_DENY_ACL $POSIX_READ_ACL ] ] 
+
+# get the initial ACL settings.
+set initial_acl [compound {Putfh $tfh; \
+        Getattr acl }]
+
+ckres "Getattr acl" $status $expcode $initial_acl $FAIL
+
+#
+# Break the string returned from the Geattr acl command into
+# a list and then extract the actual ACL settings.
+#
+set acl_list [extract_acl_list $initial_acl]
+putmsg stderr 1 "$tag: initial ACL : $acl_list"
+
+# Create the new ACL settings by replacing the appropriate entries.
+#
+# Order of entries in the list is as follows:
+# <OWNER><OWNER><GROUP><GROUP><GROUP><EVERYONE><EVERYONE>
+#
+set acl_list [lreplace $acl_list 2 2 "1 40 $group_deny_mask GROUP\@"]
+set acl_list [lreplace $acl_list 3 3 "0 40 $group_allow_mask GROUP\@"]
+set acl_list [lreplace $acl_list 4 4 "1 40 $group_deny_mask GROUP\@"]
+putmsg stderr 1 "$tag: new ACL : $acl_list"
+
+# Set the new ACL values.
+set res [compound {Putfh $tfh; \
+        Setattr $sid { {acl \
+        { $acl_list } } } } ]
+
+ckres "Setattr acl" $status $expcode $res $FAIL
+
+# Re-read ACL values
+set res2 [compound {Putfh $tfh; \
+        Getattr acl }]
+
+ckres "Getattr acl again" $status $expcode $res2 $FAIL
+
+if { $status == "OK" } {
+	set new_acl_list [extract_acl_list $res2]
+	putmsg stderr 1 "$tag: re-read ACL : $new_acl_list"
+
+	if { [compare_acl_lists $new_acl_list $acl_list] != 0} {
+        	putmsg stderr 0 \
+                	"\t Test FAIL: lists do not match."
+	} else {
+        	putmsg stdout 0 "\t Test PASS"
+	}
+}
+
+puts ""
+
+# ------------------------------------------------------------------------
+# b: Test restoring file group read perms - expect OK
+
+set tag "$TNAME{b}"
+set ASSERTION "Test restoring file group read perms - expect $expcode"
+putmsg stdout 0 "$tag: $ASSERTION"
+
+restore_perms $tfh GROUP FILE
+
+# ------------------------------------------------------------------------
+# c: Test removing file group write perms - expect OK
+
+set tag "$TNAME{c}"
+set ASSERTION "Test removing file group write perms - expect $expcode"
+putmsg stdout 0 "$tag: $ASSERTION"
+
+set sid {0 0}
+
+set group_allow_mask [ aclmask [ concat $GENERIC_ALLOW_ACL $POSIX_READ_ACL $POSIX_EXECUTE_ACL ] ] 
+
+set group_deny_mask [ aclmask [ concat $GENERIC_DENY_ACL $POSIX_WRITE_ACL ] ]
+
+# get the initial ACL settings.
+set initial_acl [compound {Putfh $tfh; \
+        Getattr acl }]
+
+ckres "Getattr acl" $status $expcode $initial_acl $FAIL
+
+#
+# Break the string returned from the Geattr acl command into
+# a list and then extract the actual ACL settings.
+#
+set acl_list [extract_acl_list $initial_acl]
+putmsg stderr 1 "$tag: initial ACL : $acl_list"
+
+# Create the new ACL settings by replacing the appropriate entries.
+#
+# Order of entries in the list is as follows:
+# <OWNER><OWNER><GROUP><GROUP><GROUP><EVERYONE><EVERYONE>
+#
+set acl_list [lreplace $acl_list 2 2 "1 40 $group_deny_mask GROUP\@"]
+set acl_list [lreplace $acl_list 3 3 "0 40 $group_allow_mask GROUP\@"]
+set acl_list [lreplace $acl_list 4 4 "1 40 $group_deny_mask GROUP\@"]
+putmsg stderr 1 "$tag: new ACL : $acl_list"
+
+
+# Set the new ACL values.
+set res [compound {Putfh $tfh; \
+        Setattr $sid { {acl \
+        { $acl_list } } } } ]
+
+ckres "Setattr acl" $status $expcode $res $FAIL
+
+# Re-read ACL values
+set res2 [compound {Putfh $tfh; \
+        Getattr acl }]
+
+ckres "Getattr acl again" $status $expcode $res2 $FAIL
+
+if { $status == "OK" } {
+	set new_acl_list [extract_acl_list $res2]
+	putmsg stderr 1 "$tag: re-read ACL : $new_acl_list"
+
+	if { [compare_acl_lists $new_acl_list $acl_list] != 0} {
+        	putmsg stderr 0 \
+                	"\t Test FAIL: lists do not match."
+	} else {
+        	putmsg stdout 0 "\t Test PASS"
+	}
+}
+
+puts ""
+
+# ------------------------------------------------------------------------
+# d: Test restoring file group write perms - expect OK
+
+set tag "$TNAME{d}"
+set ASSERTION "Test restoring file group write perms  - expect $expcode"
+putmsg stdout 0 "$tag: $ASSERTION"
+
+restore_perms $tfh GROUP FILE
+
+# ------------------------------------------------------------------------
+# e: Test removing file group execute perms - expect OK
+
+set tag "$TNAME{e}"
+set ASSERTION "Test removing file group execute perms - expect $expcode"
+putmsg stdout 0 "$tag: $ASSERTION"
+
+set sid {0 0}
+
+set group_allow_mask [ aclmask [ concat $GENERIC_ALLOW_ACL $POSIX_READ_ACL $POSIX_WRITE_ACL ] ]
+
+set group_deny_mask [ aclmask [ concat $GENERIC_DENY_ACL $POSIX_EXECUTE_ACL ] ] 
+
+# get the initial ACL settings.
+set initial_acl [compound {Putfh $tfh; \
+        Getattr acl }]
+
+ckres "Getattr acl" $status $expcode $initial_acl $FAIL
+
+#
+# Break the string returned from the Geattr acl command into
+# a list and then extract the actual ACL settings.
+#
+set acl_list [extract_acl_list $initial_acl]
+putmsg stderr 1 "$tag: initial ACL : $acl_list"
+
+# Create the new ACL settings by replacing the appropriate entries.
+#
+# Order of entries in the list is as follows:
+# <OWNER><OWNER><GROUP><GROUP><GROUP><EVERYONE><EVERYONE>
+#
+set acl_list [lreplace $acl_list 2 2 "1 40 $group_deny_mask GROUP\@"]
+set acl_list [lreplace $acl_list 3 3 "0 40 $group_allow_mask GROUP\@"]
+set acl_list [lreplace $acl_list 4 4 "1 40 $group_deny_mask GROUP\@"]
+putmsg stderr 1 "$tag: new ACL : $acl_list"
+
+
+# Set the new ACL values.
+set res [compound {Putfh $tfh; \
+        Setattr $sid { {acl \
+        { $acl_list } } } } ]
+
+ckres "Setattr acl" $status $expcode $res $FAIL
+
+# Re-read ACL values
+set res2 [compound {Putfh $tfh; \
+        Getattr acl }]
+
+ckres "Getattr acl again" $status $expcode $res2 $FAIL
+
+if { $status == "OK" } {
+	set new_acl_list [extract_acl_list $res2]
+	putmsg stderr 1 "$tag: re-read ACL : $new_acl_list"
+
+	if { [compare_acl_lists $new_acl_list $acl_list] != 0} {
+        	putmsg stderr 0 \
+                	"\t Test FAIL: lists do not match."
+	} else {
+        	putmsg stdout 0 "\t Test PASS"
+	}
+}
+
+puts ""
+
+# ------------------------------------------------------------------------
+# f: Test restoring file group execute perms - expect OK
+
+set tag "$TNAME{f}"
+set ASSERTION "Test restoring file group execute perms - expect $expcode"
+putmsg stdout 0 "$tag: $ASSERTION"
+
+restore_perms $tfh GROUP FILE
+
+# ------------------------------------------------------------------------
+# g: Test removing all file group perms - expect OK
+
+set tag "$TNAME{g}"
+set ASSERTION "Test removing all file group perms - expect $expcode"
+putmsg stdout 0 "$tag: $ASSERTION"
+
+set sid {0 0}
+
+set group_allow_mask [ aclmask [ concat $GENERIC_ALLOW_ACL ] ]
+
+set group_deny_mask [ aclmask [ concat $GENERIC_DENY_ACL $POSIX_READ_ACL $POSIX_WRITE_ACL \
+$POSIX_EXECUTE_ACL ] ]
+
+# get the initial ACL settings.
+set initial_acl [compound {Putfh $tfh; \
+        Getattr acl }]
+
+ckres "Getattr acl" $status $expcode $initial_acl $FAIL
+
+#
+# Break the string returned from the Geattr acl command into
+# a list and then extract the actual ACL settings.
+#
+set acl_list [extract_acl_list $initial_acl]
+putmsg stderr 1 "$tag: initial ACL : $acl_list"
+
+# Create the new ACL settings by replacing the appropriate entries.
+#
+# Order of entries in the list is as follows:
+# <OWNER><OWNER><GROUP><GROUP><GROUP><EVERYONE><EVERYONE>
+#
+set acl_list [lreplace $acl_list 2 2 "1 40 $group_deny_mask GROUP\@"]
+set acl_list [lreplace $acl_list 3 3 "0 40 $group_allow_mask GROUP\@"]
+set acl_list [lreplace $acl_list 4 4 "1 40 $group_deny_mask GROUP\@"]
+putmsg stderr 1 "$tag: re-read ACL : $new_acl_list"
+
+
+# Set the new ACL values.
+set res [compound {Putfh $tfh; \
+        Setattr $sid { {acl \
+        { $acl_list } } } } ]
+
+ckres "Setattr acl" $status $expcode $res $FAIL
+
+# Re-read ACL values
+set res2 [compound {Putfh $tfh; \
+        Getattr acl }]
+
+ckres "Getattr acl again" $status $expcode $res2 $FAIL
+
+if { $status == "OK" } {
+	set new_acl_list [extract_acl_list $res2]
+	putmsg stderr 1 "$tag: re-read ACL : $new_acl_list"
+
+	if { [compare_acl_lists $new_acl_list $acl_list] != 0} {
+        	putmsg stderr 0 \
+                	"\t Test FAIL: lists do not match."
+	} else {
+        	putmsg stdout 0 "\t Test PASS"
+	}
+}
+
+puts ""
+
+# ------------------------------------------------------------------------
+# h: Test restoring all file group perms - expect OK
+
+set tag "$TNAME{h}"
+set ASSERTION "Test restoring all file group perms - expect $expcode"
+putmsg stdout 0 "$tag: $ASSERTION"
+
+restore_perms $tfh GROUP FILE
+
+
+# ------------------------------------------------------------------------
+# Cleanup
+#
+set tag "$TNAME-cleanup"
+set res3 [compound {Putfh $bfh; Remove $tfile}]
+if {$status != "OK"} {
+        putmsg stderr 0 "\t WARNING: cleanup to remove created tmp file failed"
+        putmsg stderr 0 "\t          status=$status; please cleanup manually."
+        putmsg stderr 1 "\t   res=($res3)"
+        putmsg stderr 1 "  "
+}
+
+Disconnect 
+exit $PASS
