I implemented ACL support, also with support to check against a specific --user. This covers a good range of permission issues, parent directory traversal, DAC modes, POSIX-compliant ACLs (under its mask), immutable attributes, noexec, etc. We check with faccessat as well, and print all the flagged items/exit with a relevant exit code, so all that infrastructure is ready as well.