This guy gets it. Yes bingo. It's the VFS' filters/ACLs support afaik.