implementation of Posix-like ACLs