add utilities for dealing with ACLs