Hi,
1. Issue description: we update ACL rules for a same directory when multiple containers launched, but the ACL rules may be lost occasionally. However, no error is reported by setfacl.For example, after running command `setfacl-R-m u: 1234 :rwx/mnt`., the command is executed successfully, but the/mnt directory does not have the ACL rule for user 1234.

2. Cause analysis: It is found that the read/write process of the ACL rule set by setfacl is not atomic.. For example, setfacl instance A will overwrites the rule saved by instance B.
setfacl instance A：      get_acl()                               set_acl()
setfacl instance B：                 get_acl()           set_acl()

3. Recommended solution: using the flock mechanism provided by kernel to guarantee the read/write process is atomic.The approximate solution is described as follows:
```
int
do_set(
const char *path_p,
const struct stat *st,
int walk_flags,
void *arg)
{
........
+   /* skip setting if the rule is redundant */
+ if (do_set_need_skip())：
    return；

+   /* add lock to guarantee the atomic read-write process */
+ flock(path_p);
RETRIEVE_ACL(cmd->c_type); get acl rules
.............

if (acl_set_file(path_p, ACL_TYPE_ACCESS, acl) != 0) { set acl rules
+   unlock();
.......
}
```
for details, refer to the attachment.