the problem with this is that the exact flag combination sometimes even differs between different OSs. Your best bet would be to configure a dummy folder the way you want it to be and then use madSecurity to list the contents of the ACL. That way you will know which flags the OS wants to have for the given configuration. You need to replace GENERIC_ALL with something else.