diff --git a/lib/cib/cib_file.c b/lib/cib/cib_file.c

index 5562e9e..aa68679 100644

--- a/lib/cib/cib_file.c

+++ b/lib/cib/cib_file.c

@@ -310,6 +310,12 @@ cib_file_perform_op_delegate(cib_t * cib, const char *op, const char *host, cons

     }

     crm_trace("Performing %s operation as %s", op, user_name);

 #endif

+

+    /* Mirror the logic in cib_prepare_common() */

+    if (section != NULL && data != NULL && crm_str_eq(crm_element_name(data), XML_TAG_CIB, TRUE)) {

+        data = get_object_root(section, data);

+    }

+

     rc = cib_perform_op(op, call_options, fn, query,

                         section, request, data, TRUE, &changed, in_mem_cib, &result_cib, &cib_diff,

                         &output);

diff --git a/lib/common/xml.c b/lib/common/xml.c

index f7779f5..54f1aa7 100644

--- a/lib/common/xml.c

+++ b/lib/common/xml.c

@@ -4848,8 +4848,13 @@ replace_xml_child(xmlNode * parent, xmlNode * child, xmlNode * update, gboolean

             xml_accept_changes(tmp);

             old = xmlReplaceNode(child, tmp);

-            xml_calculate_changes(old, tmp);

+            if(xml_tracking_changes(tmp)) {

+                /* Replaced sections may have included relevant ACLs */

+                __xml_acl_apply(tmp);

+            }

+

+            xml_calculate_changes(old, tmp);

             xmlDocSetRootElement(doc, old);

             free_xml(old);

         }

diff --git a/tools/regression.acls.exp b/tools/regression.acls.exp

index 2cea125..e05e339 100644

--- a/tools/regression.acls.exp

+++ b/tools/regression.acls.exp

@@ -17,11 +17,18 @@ A new shadow instance was created.  To begin using it paste the following into y

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

     </acls>

   </configuration>

   <status/>

@@ -47,11 +54,18 @@ A new shadow instance was created.  To begin using it paste the following into y

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

     </acls>

   </configuration>

   <status/>

@@ -78,11 +92,18 @@ A new shadow instance was created.  To begin using it paste the following into y

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

     </acls>

   </configuration>

   <status/>

@@ -109,11 +130,18 @@ A new shadow instance was created.  To begin using it paste the following into y

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -143,11 +171,18 @@ A new shadow instance was created.  To begin using it paste the following into y

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -180,11 +215,18 @@ A new shadow instance was created.  To begin using it paste the following into y

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -255,11 +297,18 @@ Call failed: Permission denied

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -301,11 +350,18 @@ __xml_acl_post_process: 	Creation of nvpair=cib-bootstrap-options-stonith-enable

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -345,11 +401,18 @@ Call failed: Permission denied

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -384,11 +447,18 @@ Call failed: Permission denied

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -425,11 +495,18 @@ Call failed: Permission denied

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -486,11 +563,18 @@ __xml_acl_post_process: 	Creation of nvpair=dummy-meta_attributes-target-role is

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -535,11 +619,18 @@ Stopped

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -582,11 +673,18 @@ Deleted dummy option: id=dummy-meta_attributes-target-role name=target-role

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -631,11 +729,18 @@ __xml_acl_post_process: 	Creation of nvpair=dummy-meta_attributes-target-role is

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -730,11 +835,18 @@ Call failed: Permission denied

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -778,11 +890,18 @@ Call failed: Permission denied

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -794,12 +913,12 @@ Call failed: Permission denied

   </configuration>

   <status/>

 </cib>

-=#=#=#= Begin test: niceguy: Replace - modify attribute =#=#=#=

+=#=#=#= Begin test: niceguy: Replace - modify attribute (deny) =#=#=#=

 __xml_acl_check: 	400 access denied to /cib[@epoch]: default

 __xml_acl_check: 	400 access denied to /cib/configuration/crm_config/cluster_property_set[@id='cib-bootstrap-options']/nvpair[@id='cib-bootstrap-options-enable-acl'][@value]: default

 Call failed: Permission denied

-=#=#=#= End test: niceguy: Replace - modify attribute - Permission denied (13) =#=#=#=

-* Passed: cibadmin       - niceguy: Replace - modify attribute

+=#=#=#= End test: niceguy: Replace - modify attribute (deny) - Permission denied (13) =#=#=#=

+* Passed: cibadmin       - niceguy: Replace - modify attribute (deny)

 <cib epoch="13" num_updates="0" admin_epoch="0">

   <configuration>

     <crm_config>

@@ -825,11 +944,18 @@ Call failed: Permission denied

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -841,12 +967,12 @@ Call failed: Permission denied

   </configuration>

   <status/>

 </cib>

-=#=#=#= Begin test: niceguy: Replace - delete attribute =#=#=#=

+=#=#=#= Begin test: niceguy: Replace - delete attribute (deny) =#=#=#=

 __xml_acl_check: 	400 access denied to /cib[@epoch]: default

 __xml_acl_check: 	400 access denied to /cib/configuration/crm_config/cluster_property_set[@id='cib-bootstrap-options']/nvpair[@id='cib-bootstrap-options-enable-acl']: default

 Call failed: Permission denied

-=#=#=#= End test: niceguy: Replace - delete attribute - Permission denied (13) =#=#=#=

-* Passed: cibadmin       - niceguy: Replace - delete attribute

+=#=#=#= End test: niceguy: Replace - delete attribute (deny) - Permission denied (13) =#=#=#=

+* Passed: cibadmin       - niceguy: Replace - delete attribute (deny)

 <cib epoch="13" num_updates="0" admin_epoch="0">

   <configuration>

     <crm_config>

@@ -872,11 +998,18 @@ Call failed: Permission denied

       <acl_user id="niceguy">

         <role_ref id="observer"/>

       </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

       <acl_role id="observer">

         <read id="observer-read-1" xpath="/cib"/>

         <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

         <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

       <acl_user id="badidea">

         <read id="badidea-resources" xpath="//meta_attributes"/>

       </acl_user>

@@ -888,12 +1021,161 @@ Call failed: Permission denied

   </configuration>

   <status/>

 </cib>

-=#=#=#= Begin test: niceguy: Replace - create attribute =#=#=#=

+=#=#=#= Begin test: niceguy: Replace - create attribute (deny) =#=#=#=

 __xml_acl_check: 	400 access denied to /cib[@epoch]: default

 __xml_acl_check: 	400 access denied to /cib/configuration/resources/primitive[@id='dummy'][@description]: default

 Call failed: Permission denied

-=#=#=#= End test: niceguy: Replace - create attribute - Permission denied (13) =#=#=#=

-* Passed: cibadmin       - niceguy: Replace - create attribute

+=#=#=#= End test: niceguy: Replace - create attribute (deny) - Permission denied (13) =#=#=#=

+* Passed: cibadmin       - niceguy: Replace - create attribute (deny)

+<cib epoch="13" num_updates="0" admin_epoch="0">

+  <configuration>

+    <crm_config>

+      <cluster_property_set id="cib-bootstrap-options">

+        <nvpair id="cib-bootstrap-options-enable-acl" name="enable-acl" value="true"/>

+        <nvpair id="cib-bootstrap-options-no-quorum-policy" name="no-quorum-policy" value="ignore"/>

+        <nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="true"/>

+      </cluster_property_set>

+    </crm_config>

+    <nodes/>

+    <resources>

+      <primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy" description="nothing interesting">

+        <meta_attributes id="dummy-meta_attributes">

+          <nvpair id="dummy-meta_attributes-target-role" name="target-role" value="Started"/>

+        </meta_attributes>

+      </primitive>

+    </resources>

+    <constraints/>

+    <acls>

+      <acl_user id="l33t-haxor">

+        <deny id="crook-nothing" xpath="/cib"/>

+      </acl_user>

+      <acl_user id="niceguy">

+        <role_ref id="observer"/>

+      </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

+      <acl_role id="observer">

+        <read id="observer-read-1" xpath="/cib"/>

+        <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

+        <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

+      </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

+      <acl_user id="badidea">

+        <read id="badidea-resources" xpath="//meta_attributes"/>

+      </acl_user>

+      <acl_user id="betteridea">

+        <deny id="betteridea-nothing" xpath="/cib"/>

+        <read id="betteridea-resources" xpath="//meta_attributes"/>

+      </acl_user>

+    </acls>

+  </configuration>

+  <status/>

+</cib>

+=#=#=#= Begin test: bob: Replace - create attribute (allow) =#=#=#=

+=#=#=#= End test: bob: Replace - create attribute (allow) - OK (0) =#=#=#=

+* Passed: cibadmin       - bob: Replace - create attribute (allow)

+<cib epoch="14" num_updates="0" admin_epoch="0">

+  <configuration>

+    <crm_config>

+      <cluster_property_set id="cib-bootstrap-options">

+        <nvpair id="cib-bootstrap-options-enable-acl" name="enable-acl" value="true"/>

+        <nvpair id="cib-bootstrap-options-no-quorum-policy" name="no-quorum-policy" value="ignore"/>

+        <nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="true"/>

+      </cluster_property_set>

+    </crm_config>

+    <nodes/>

+    <resources>

+      <primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy" description="something interesting">

+        <meta_attributes id="dummy-meta_attributes">

+          <nvpair id="dummy-meta_attributes-target-role" name="target-role" value="Started"/>

+        </meta_attributes>

+      </primitive>

+    </resources>

+    <constraints/>

+    <acls>

+      <acl_user id="l33t-haxor">

+        <deny id="crook-nothing" xpath="/cib"/>

+      </acl_user>

+      <acl_user id="niceguy">

+        <role_ref id="observer"/>

+      </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

+      <acl_role id="observer">

+        <read id="observer-read-1" xpath="/cib"/>

+        <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

+        <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

+      </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

+      <acl_user id="badidea">

+        <read id="badidea-resources" xpath="//meta_attributes"/>

+      </acl_user>

+      <acl_user id="betteridea">

+        <deny id="betteridea-nothing" xpath="/cib"/>

+        <read id="betteridea-resources" xpath="//meta_attributes"/>

+      </acl_user>

+    </acls>

+  </configuration>

+  <status/>

+</cib>

+=#=#=#= Begin test: bob: Replace - modify attribute (allow) =#=#=#=

+=#=#=#= End test: bob: Replace - modify attribute (allow) - OK (0) =#=#=#=

+* Passed: cibadmin       - bob: Replace - modify attribute (allow)

+<cib epoch="15" num_updates="0" admin_epoch="0">

+  <configuration>

+    <crm_config>

+      <cluster_property_set id="cib-bootstrap-options">

+        <nvpair id="cib-bootstrap-options-enable-acl" name="enable-acl" value="true"/>

+        <nvpair id="cib-bootstrap-options-no-quorum-policy" name="no-quorum-policy" value="ignore"/>

+        <nvpair id="cib-bootstrap-options-stonith-enabled" name="stonith-enabled" value="true"/>

+      </cluster_property_set>

+    </crm_config>

+    <nodes/>

+    <resources>

+      <primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>

+    </resources>

+    <constraints/>

+    <acls>

+      <acl_user id="l33t-haxor">

+        <deny id="crook-nothing" xpath="/cib"/>

+      </acl_user>

+      <acl_user id="niceguy">

+        <role_ref id="observer"/>

+      </acl_user>

+      <acl_user id="bob">

+        <role_ref id="admin"/>

+      </acl_user>

+      <acl_role id="observer">

+        <read id="observer-read-1" xpath="/cib"/>

+        <write id="observer-write-1" xpath="//nvpair[@name='stonith-enabled']"/>

+        <write id="observer-write-2" xpath="//nvpair[@name='target-role']"/>

+      </acl_role>

+      <acl_role id="admin">

+        <read id="admin-read-1" xpath="/cib"/>

+        <write id="admin-write-1" xpath="//resources"/>

+      </acl_role>

+      <acl_user id="badidea">

+        <read id="badidea-resources" xpath="//meta_attributes"/>

+      </acl_user>

+      <acl_user id="betteridea">

+        <deny id="betteridea-nothing" xpath="/cib"/>

+        <read id="betteridea-resources" xpath="//meta_attributes"/>

+      </acl_user>

+    </acls>

+  </configuration>

+  <status/>

+</cib>

+=#=#=#= Begin test: bob: Replace - delete attribute (allow) =#=#=#=

+=#=#=#= End test: bob: Replace - delete attribute (allow) - OK (0) =#=#=#=

+* Passed: cibadmin       - bob: Replace - delete attribute (allow)

     !#!#!#!#! Upgrading to pacemaker-2.0 and retesting !#!#!#!#!

@@ -901,6 +1183,8 @@ Call failed: Permission denied

 __xml_acl_post_process: 	Creation of acl_permission=observer-read-1 is allowed

 __xml_acl_post_process: 	Creation of acl_permission=observer-write-1 is allowed

 __xml_acl_post_process: 	Creation of acl_permission=observer-write-2 is allowed

+__xml_acl_post_process: 	Creation of acl_permission=admin-read-1 is allowed

+__xml_acl_post_process: 	Creation of acl_permission=admin-write-1 is allowed

 __xml_acl_post_process: 	Creation of acl_permission=crook-nothing is allowed

 __xml_acl_post_process: 	Creation of acl_permission=badidea-resources is allowed

 __xml_acl_post_process: 	Creation of acl_permission=betteridea-nothing is allowed

@@ -917,11 +1201,7 @@ __xml_acl_post_process: 	Creation of acl_permission=betteridea-resources is allo

     </crm_config>

     <nodes/>

     <resources>

-      <primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy">

-        <meta_attributes id="dummy-meta_attributes">

-          <nvpair id="dummy-meta_attributes-target-role" name="target-role" value="Started"/>

-        </meta_attributes>

-      </primitive>

+      <primitive id="dummy" class="ocf" provider="pacemaker" type="Dummy"/>

     </resources>

     <constraints/>

     <acls>

@@ -934,11 +1214,18 @@ __xml_acl_post_process: 	Creation of acl_permission=betteridea-resources is allo

       <acl_target id="niceguy">

         <role id="observer"/>

       </acl_target>

+      <acl_target id="bob">

+        <role id="admin"/>

+      </acl_target>

       <acl_role id="observer">

         <acl_permission id="observer-read-1" kind="read" xpath="/cib"/>

         <acl_permission id="observer-write-1" kind="write" xpath="//nvpair[@name='stonith-enabled']"/>

         <acl_permission id="observer-write-2" kind="write" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <acl_permission id="admin-read-1" kind="read" xpath="/cib"/>

+        <acl_permission id="admin-write-1" kind="write" xpath="//resources"/>

+      </acl_role>

       <acl_target id="badidea">

         <role id="auto-badidea"/>

       </acl_target>

@@ -1019,11 +1306,18 @@ Call failed: Permission denied

       <acl_target id="niceguy">

         <role id="observer"/>

       </acl_target>

+      <acl_target id="bob">

+        <role id="admin"/>

+      </acl_target>

       <acl_role id="observer">

         <acl_permission id="observer-read-1" kind="read" xpath="/cib"/>

         <acl_permission id="observer-write-1" kind="write" xpath="//nvpair[@name='stonith-enabled']"/>

         <acl_permission id="observer-write-2" kind="write" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <acl_permission id="admin-read-1" kind="read" xpath="/cib"/>

+        <acl_permission id="admin-write-1" kind="write" xpath="//resources"/>

+      </acl_role>

       <acl_target id="badidea">

         <role id="auto-badidea"/>

       </acl_target>

@@ -1073,11 +1367,18 @@ Error setting enable-acl=false (section=crm_config, set=<null>): Permission deni

       <acl_target id="niceguy">

         <role id="observer"/>

       </acl_target>

+      <acl_target id="bob">

+        <role id="admin"/>

+      </acl_target>

       <acl_role id="observer">

         <acl_permission id="observer-read-1" kind="read" xpath="/cib"/>

         <acl_permission id="observer-write-1" kind="write" xpath="//nvpair[@name='stonith-enabled']"/>

         <acl_permission id="observer-write-2" kind="write" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <acl_permission id="admin-read-1" kind="read" xpath="/cib"/>

+        <acl_permission id="admin-write-1" kind="write" xpath="//resources"/>

+      </acl_role>

       <acl_target id="badidea">

         <role id="auto-badidea"/>

       </acl_target>

@@ -1126,11 +1427,18 @@ Call failed: Permission denied

       <acl_target id="niceguy">

         <role id="observer"/>

       </acl_target>

+      <acl_target id="bob">

+        <role id="admin"/>

+      </acl_target>

       <acl_role id="observer">

         <acl_permission id="observer-read-1" kind="read" xpath="/cib"/>

         <acl_permission id="observer-write-1" kind="write" xpath="//nvpair[@name='stonith-enabled']"/>

         <acl_permission id="observer-write-2" kind="write" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <acl_permission id="admin-read-1" kind="read" xpath="/cib"/>

+        <acl_permission id="admin-write-1" kind="write" xpath="//resources"/>

+      </acl_role>

       <acl_target id="badidea">

         <role id="auto-badidea"/>

       </acl_target>

@@ -1174,11 +1482,18 @@ Call failed: Permission denied

       <acl_target id="niceguy">

         <role id="observer"/>

       </acl_target>

+      <acl_target id="bob">

+        <role id="admin"/>

+      </acl_target>

       <acl_role id="observer">

         <acl_permission id="observer-read-1" kind="read" xpath="/cib"/>

         <acl_permission id="observer-write-1" kind="write" xpath="//nvpair[@name='stonith-enabled']"/>

         <acl_permission id="observer-write-2" kind="write" xpath="//nvpair[@name='target-role']"/>

       </acl_role>

+      <acl_role id="admin">

+        <acl_permission id="admin-read-1" kind="read" xpath="/cib"/>

+        <acl_permission id="admin-write-1" kind="write" xpath="//resources"/>

+      </acl_role>

       <acl_target id="badidea">

         <role id="auto-badidea"/>

       </acl_target>

@@ -1224,11 +1539,18 @@ Call failed: Permission denied

       <acl_target id="niceguy">

         <role id="observer"/>

       </acl_target>