It seems like a better solution here would be to do a getattr on just the auth bit so that we can do a correct (but sometimes less expensive) attr check (e.g., by not having to stop file i/o) and doing our own check.  If we blindly return 0 here, we're disabling access control entirely.  That might be okay to support via a new config option (fuse_disable_permissions or something), but not by default?