Thanks! The setacl command was just what I needed.