Comment by opello

https://www.rfc-editor.org/rfc/rfc8881#section-6.2.1

I see what I misunderstood, even in the presence of an ALLOW entry, a DENY entry would prohibit access. I am familiar with that on the Windows side but haven't really dug into Linux ACLs. The ACCESS CHECK ALGORITHM[1] section of the acl(5) man page was pretty clear, I think.

[1] https://man7.org/linux/man-pages/man5/acl.5.html#ACCESS_CHEC...