If nothing else, setfacl -bn seems to be the magic incantation to drop the ACLs and get back to regular dumb permissions.