diff --git a/cmd/zfs/zfs_main.c b/cmd/zfs/zfs_main.c
index 7525afcbfd6d..9a87601d413c 100644
--- a/cmd/zfs/zfs_main.c
+++ b/cmd/zfs/zfs_main.c
@@ -4971,7 +4971,7 @@ construct_fsacl_list(boolean_t un, struct allow_opts *opts, nvlist_t **nvlp)
 				else {
 					(void) snprintf(errbuf, 256, gettext(
 					    "invalid user %s"), curr);
-					allow_usage(un, B_TRUE, errbuf);
+					allow_usage(un, B_FALSE, errbuf);
 				}
 			} else if (opts->group) {
 				who_type = ZFS_DELEG_GROUP;
@@ -4985,7 +4985,7 @@ construct_fsacl_list(boolean_t un, struct allow_opts *opts, nvlist_t **nvlp)
 				else {
 					(void) snprintf(errbuf, 256, gettext(
 					    "invalid group %s"),  curr);
-					allow_usage(un, B_TRUE, errbuf);
+					allow_usage(un, B_FALSE, errbuf);
 				}
 			} else {
 				if (*endch != '\0') {
@@ -5011,7 +5011,7 @@ construct_fsacl_list(boolean_t un, struct allow_opts *opts, nvlist_t **nvlp)
 				} else {
 					(void) snprintf(errbuf, 256, gettext(
 					    "invalid user/group %s"), curr);
-					allow_usage(un, B_TRUE, errbuf);
+					allow_usage(un, B_FALSE, errbuf);
 				}
 			}
 
diff --git a/cmd/zpool/zpool_main.c b/cmd/zpool/zpool_main.c
index 50a332c6f6bf..1eee6d07bc45 100644
--- a/cmd/zpool/zpool_main.c
+++ b/cmd/zpool/zpool_main.c
@@ -42,7 +42,6 @@
 #include <string.h>
 #include <strings.h>
 #include <unistd.h>
-#include <priv.h>
 #include <pwd.h>
 #include <zone.h>
 #include <zfs_prop.h>
@@ -2254,21 +2253,21 @@ zpool_do_import(int argc, char **argv)
 			(void) fprintf(stderr, gettext("too many arguments\n"));
 			usage(B_FALSE);
 		}
+	}
 
-		/*
-		 * Check for the SYS_CONFIG privilege.  We do this explicitly
-		 * here because otherwise any attempt to discover pools will
-		 * silently fail.
-		 */
-		if (argc == 0 && !priv_ineffect(PRIV_SYS_CONFIG)) {
-			(void) fprintf(stderr, gettext("cannot "
-			    "discover pools: permission denied\n"));
-			if (searchdirs != NULL)
-				free(searchdirs);
+	/*
+	 * Check for the effective uid.  We do this explicitly
+	 * here because otherwise any attempt to discover pools will
+	 * silently fail.
+	 */
+	if (argc == 0 && geteuid() != 0) {
+		(void) fprintf(stderr, gettext("cannot "
+		    "discover pools: permission denied\n"));
+		if (searchdirs != NULL)
+			free(searchdirs);
 
-			nvlist_free(policy);
-			return (1);
-		}
+		nvlist_free(policy);
+		return (1);
 	}
 
 	/*
diff --git a/include/sys/Makefile.am b/include/sys/Makefile.am
index 98d7ad6fb061..c080a9792661 100644
--- a/include/sys/Makefile.am
+++ b/include/sys/Makefile.am
@@ -39,6 +39,7 @@ COMMON_H = \
 	$(top_srcdir)/include/sys/nvpair.h \
 	$(top_srcdir)/include/sys/nvpair_impl.h \
 	$(top_srcdir)/include/sys/pathname.h \
+	$(top_srcdir)/include/sys/policy.h \
 	$(top_srcdir)/include/sys/range_tree.h \
 	$(top_srcdir)/include/sys/refcount.h \
 	$(top_srcdir)/include/sys/rrwlock.h \
diff --git a/include/sys/policy.h b/include/sys/policy.h
new file mode 100644
index 000000000000..23d7d4db77f2
--- /dev/null
+++ b/include/sys/policy.h
@@ -0,0 +1,60 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2015, Joyent, Inc. All rights reserved.
+ * Copyright (c) 2016, Lawrence Livermore National Security, LLC.
+ */
+
+#ifndef _SYS_POLICY_H
+#define	_SYS_POLICY_H
+
+#ifdef _KERNEL
+
+#include <sys/cred.h>
+#include <sys/types.h>
+#include <sys/xvattr.h>
+#include <sys/zpl.h>
+
+int secpolicy_nfs(const cred_t *);
+int secpolicy_sys_config(const cred_t *, boolean_t);
+int secpolicy_vnode_access2(const cred_t *, struct inode *,
+    uid_t, mode_t, mode_t);
+int secpolicy_vnode_any_access(const cred_t *, struct inode *, uid_t);
+int secpolicy_vnode_chown(const cred_t *, uid_t);
+int secpolicy_vnode_create_gid(const cred_t *);
+int secpolicy_vnode_remove(const cred_t *);
+int secpolicy_vnode_setdac(const cred_t *, uid_t);
+int secpolicy_vnode_setid_retain(const cred_t *, boolean_t);
+int secpolicy_vnode_setids_setgids(const cred_t *, gid_t);
+int secpolicy_zinject(const cred_t *);
+int secpolicy_zfs(const cred_t *);
+void secpolicy_setid_clear(vattr_t *, cred_t *);
+int secpolicy_setid_setsticky_clear(struct inode *, vattr_t *,
+    const vattr_t *, cred_t *);
+int secpolicy_xvattr(xvattr_t *, uid_t, cred_t *, vtype_t);
+int secpolicy_vnode_setattr(cred_t *, struct inode *, struct vattr *,
+    const struct vattr *, int, int (void *, int, cred_t *), void *);
+int secpolicy_basic_link(const cred_t *);
+
+#endif /* _KERNEL */
+#endif /* _SYS_POLICY_H */
diff --git a/include/sys/zfs_context.h b/include/sys/zfs_context.h
index e68223eb30e6..ee4abc7e3db5 100644
--- a/include/sys/zfs_context.h
+++ b/include/sys/zfs_context.h
@@ -734,6 +734,7 @@ extern int zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr);
 extern int zfs_secpolicy_rename_perms(const char *from, const char *to,
     cred_t *cr);
 extern int zfs_secpolicy_destroy_perms(const char *name, cred_t *cr);
+extern int secpolicy_zfs(const cred_t *cr);
 extern zoneid_t getzoneid(void);
 
 /* SID stuff */
diff --git a/lib/libspl/include/Makefile.am b/lib/libspl/include/Makefile.am
index 626a8f46b001..7882c1b9c6d3 100644
--- a/lib/libspl/include/Makefile.am
+++ b/lib/libspl/include/Makefile.am
@@ -12,7 +12,6 @@ libspl_HEADERS = \
 	$(top_srcdir)/lib/libspl/include/limits.h \
 	$(top_srcdir)/lib/libspl/include/locale.h \
 	$(top_srcdir)/lib/libspl/include/note.h \
-	$(top_srcdir)/lib/libspl/include/priv.h \
 	$(top_srcdir)/lib/libspl/include/statcommon.h \
 	$(top_srcdir)/lib/libspl/include/stdio.h \
 	$(top_srcdir)/lib/libspl/include/stdlib.h \
diff --git a/lib/libspl/include/priv.h b/lib/libspl/include/priv.h
deleted file mode 100644
index 15b76a4006ff..000000000000
--- a/lib/libspl/include/priv.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * CDDL HEADER START
- *
- * The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License").  You may not use this file except in compliance
- * with the License.
- *
- * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
- * or http://www.opensolaris.org/os/licensing.
- * See the License for the specific language governing permissions
- * and limitations under the License.
- *
- * When distributing Covered Code, include this CDDL HEADER in each
- * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
- * If applicable, add the following below this CDDL HEADER, with the
- * fields enclosed by brackets "[]" replaced with your own identifying
- * information: Portions Copyright [yyyy] [name of copyright owner]
- *
- * CDDL HEADER END
- */
-/*
- * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
- * Use is subject to license terms.
- */
-
-#ifndef _LIBSPL_PRIV_H
-#define	_LIBSPL_PRIV_H
-
-#include <sys/types.h>
-
-/* Couldn't find this definition in OpenGrok */
-#define	PRIV_SYS_CONFIG	"sys_config"
-
-/*
- * priv_op_t indicates a privilege operation type
- */
-typedef enum priv_op {
-	PRIV_ON,
-	PRIV_OFF,
-	PRIV_SET
-} priv_op_t;
-
-static inline boolean_t priv_ineffect(const char *priv) { return B_TRUE; }
-
-#endif
diff --git a/lib/libzfs/libzfs_dataset.c b/lib/libzfs/libzfs_dataset.c
index 1d9e5156a34a..ddc554bdd474 100644
--- a/lib/libzfs/libzfs_dataset.c
+++ b/lib/libzfs/libzfs_dataset.c
@@ -43,7 +43,6 @@
 #include <fcntl.h>
 #include <sys/mntent.h>
 #include <sys/mount.h>
-#include <priv.h>
 #include <pwd.h>
 #include <grp.h>
 #include <stddef.h>
diff --git a/lib/libzpool/kernel.c b/lib/libzpool/kernel.c
index 49d17ece3273..4295d660155f 100644
--- a/lib/libzpool/kernel.c
+++ b/lib/libzpool/kernel.c
@@ -1260,6 +1260,12 @@ zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
 	return (0);
 }
 
+int
+secpolicy_zfs(const cred_t *cr)
+{
+	return (0);
+}
+
 ksiddomain_t *
 ksid_lookupdomain(const char *dom)
 {
diff --git a/module/zfs/Makefile.in b/module/zfs/Makefile.in
index f33faf157cc8..33f923ffd5c2 100644
--- a/module/zfs/Makefile.in
+++ b/module/zfs/Makefile.in
@@ -43,6 +43,7 @@ $(MODULE)-objs += lz4.o
 $(MODULE)-objs += metaslab.o
 $(MODULE)-objs += multilist.o
 $(MODULE)-objs += pathname.o
+$(MODULE)-objs += policy.o
 $(MODULE)-objs += range_tree.o
 $(MODULE)-objs += refcount.o
 $(MODULE)-objs += rrwlock.o
diff --git a/module/zfs/dmu_objset.c b/module/zfs/dmu_objset.c
index f9c534eb5736..2889467d247e 100644
--- a/module/zfs/dmu_objset.c
+++ b/module/zfs/dmu_objset.c
@@ -52,6 +52,7 @@
 #include <sys/zfs_onexit.h>
 #include <sys/dsl_destroy.h>
 #include <sys/vdev.h>
+#include <sys/policy.h>
 
 /*
  * Needed to close a window in dnode_move() that allows the objset to be freed
@@ -882,7 +883,7 @@ dmu_objset_create(const char *name, dmu_objset_type_t type, uint64_t flags,
 	dmu_objset_create_arg_t doca;
 
 	doca.doca_name = name;
-	doca.doca_cred = CRED();
+	doca.doca_cred = kcred;
 	doca.doca_flags = flags;
 	doca.doca_userfunc = func;
 	doca.doca_userarg = arg;
@@ -977,7 +978,7 @@ dmu_objset_clone(const char *clone, const char *origin)
 
 	doca.doca_clone = clone;
 	doca.doca_origin = origin;
-	doca.doca_cred = CRED();
+	doca.doca_cred = kcred;
 
 	return (dsl_sync_task(clone,
 	    dmu_objset_clone_check, dmu_objset_clone_sync, &doca,
diff --git a/module/zfs/dmu_send.c b/module/zfs/dmu_send.c
index 613770e10d33..cf3fdb994506 100644
--- a/module/zfs/dmu_send.c
+++ b/module/zfs/dmu_send.c
@@ -56,6 +56,7 @@
 #include <sys/zfeature.h>
 #include <sys/bqueue.h>
 #include <sys/zvol.h>
+#include <sys/policy.h>
 
 /* Set this tunable to TRUE to replace corrupt data with 0x2f5baddb10c */
 int zfs_send_corrupt_data = B_FALSE;
@@ -1411,7 +1412,7 @@ dmu_recv_begin(char *tofs, char *tosnap, struct drr_begin *drrb,
 	drc->drc_tosnap = tosnap;
 	drc->drc_tofs = tofs;
 	drc->drc_force = force;
-	drc->drc_cred = CRED();
+	drc->drc_cred = kcred;
 
 	if (drrb->drr_magic == BSWAP_64(DMU_BACKUP_MAGIC))
 		drc->drc_byteswap = B_TRUE;
@@ -1441,7 +1442,7 @@ dmu_recv_begin(char *tofs, char *tosnap, struct drr_begin *drrb,
 
 	drba.drba_origin = origin;
 	drba.drba_cookie = drc;
-	drba.drba_cred = CRED();
+	drba.drba_cred = kcred;
 
 	return (dsl_sync_task(tofs, dmu_recv_begin_check, dmu_recv_begin_sync,
 	    &drba, 5, ZFS_SPACE_CHECK_NORMAL));
diff --git a/module/zfs/dsl_dataset.c b/module/zfs/dsl_dataset.c
index 230027daf995..2a501c55e89e 100644
--- a/module/zfs/dsl_dataset.c
+++ b/module/zfs/dsl_dataset.c
@@ -51,6 +51,7 @@
 #include <sys/dsl_destroy.h>
 #include <sys/dsl_userhold.h>
 #include <sys/dsl_bookmark.h>
+#include <sys/policy.h>
 
 /*
  * The SPA supports block sizes up to 16MB.  However, very large blocks
@@ -1483,7 +1484,7 @@ dsl_dataset_snapshot(nvlist_t *snaps, nvlist_t *props, nvlist_t *errors)
 	ddsa.ddsa_snaps = snaps;
 	ddsa.ddsa_props = props;
 	ddsa.ddsa_errors = errors;
-	ddsa.ddsa_cr = CRED();
+	ddsa.ddsa_cr = kcred;
 
 	if (error == 0) {
 		error = dsl_sync_task(firstname, dsl_dataset_snapshot_check,
@@ -2673,7 +2674,7 @@ dsl_dataset_promote(const char *name, char *conflsnap)
 
 	ddpa.ddpa_clonename = name;
 	ddpa.err_ds = conflsnap;
-	ddpa.cr = CRED();
+	ddpa.cr = kcred;
 
 	return (dsl_sync_task(name, dsl_dataset_promote_check,
 	    dsl_dataset_promote_sync, &ddpa,
diff --git a/module/zfs/dsl_dir.c b/module/zfs/dsl_dir.c
index 8983e0793f23..053e9cf8fd8b 100644
--- a/module/zfs/dsl_dir.c
+++ b/module/zfs/dsl_dir.c
@@ -1926,7 +1926,7 @@ dsl_dir_rename(const char *oldname, const char *newname)
 
 	ddra.ddra_oldname = oldname;
 	ddra.ddra_newname = newname;
-	ddra.ddra_cred = CRED();
+	ddra.ddra_cred = kcred;
 
 	return (dsl_sync_task(oldname,
 	    dsl_dir_rename_check, dsl_dir_rename_sync, &ddra,
diff --git a/module/zfs/policy.c b/module/zfs/policy.c
new file mode 100644
index 000000000000..4233ef46d724
--- /dev/null
+++ b/module/zfs/policy.c
@@ -0,0 +1,301 @@
+/*
+ * CDDL HEADER START
+ *
+ * The contents of this file are subject to the terms of the
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
+ *
+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+ * or http://www.opensolaris.org/os/licensing.
+ * See the License for the specific language governing permissions
+ * and limitations under the License.
+ *
+ * When distributing Covered Code, include this CDDL HEADER in each
+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+ * If applicable, add the following below this CDDL HEADER, with the
+ * fields enclosed by brackets "[]" replaced with your own identifying
+ * information: Portions Copyright [yyyy] [name of copyright owner]
+ *
+ * CDDL HEADER END
+ */
+
+/*
+ * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2013, Joyent, Inc. All rights reserved.
+ * Copyright (C) 2016 Lawrence Livermore National Security, LLC.
+ *
+ * For Linux the vast majority of this enforcement is already handled via
+ * the standard Linux VFS permission checks.  However certain administrative
+ * commands which bypass the standard mechanisms may need to make use of
+ * this functionality.
+ */
+
+#include <sys/policy.h>
+#include <linux/security.h>
+#include <linux/vfs_compat.h>
+
+/*
+ * The passed credentials are currently not directly checked since Linux
+ * only provides interfaces for checking the current credentials.  This
+ * aligns with the long standing ZFS behavior of using CRED() to get the
+ * current credentials.  Therefore, this function is performing the same
+ * check.  The VERIFY() check below guarantee this is always true.
+ */
+static int
+priv_policy(const cred_t *cr, int capability, boolean_t all, int err)
+{
+	VERIFY(cr == CRED() || cr == kcred);
+	ASSERT3S(all, ==, B_FALSE);
+
+	if (!capable(capability))
+		return (err);
+
+	return (0);
+}
+
+/*
+ * Checks for operations that are either client-only or are used by
+ * both clients and servers.
+ */
+int
+secpolicy_nfs(const cred_t *cr)
+{
+	return (priv_policy(cr, CAP_SYS_ADMIN, B_FALSE, EPERM));
+}
+
+/*
+ * Catch all system configuration.
+ */
+int
+secpolicy_sys_config(const cred_t *cr, boolean_t checkonly)
+{
+	return (priv_policy(cr, CAP_SYS_ADMIN, B_FALSE, EPERM));
+}
+
+/*
+ * Like secpolicy_vnode_access() but we get the actual wanted mode and the
+ * current mode of the file, not the missing bits.
+ *
+ * Enforced in the Linux VFS.
+ */
+int
+secpolicy_vnode_access2(const cred_t *cr, struct inode *ip, uid_t owner,
+	mode_t curmode, mode_t wantmode)
+{
+	return (0);
+}
+
+/*
+ * This is a special routine for ZFS; it is used to determine whether
+ * any of the privileges in effect allow any form of access to the
+ * file.  There's no reason to audit this or any reason to record
+ * this.  More work is needed to do the "KPLD" stuff.
+ */
+int
+secpolicy_vnode_any_access(const cred_t *cr, struct inode *ip, uid_t owner)
+{
+	if (crgetuid(cr) == owner)
+		return (0);
+
+	if (zpl_inode_owner_or_capable(ip))
+		return (0);
+
+	if (priv_policy(cr, CAP_DAC_OVERRIDE, B_FALSE, EPERM) == 0)
+		return (0);
+
+	if (priv_policy(cr, CAP_DAC_READ_SEARCH, B_FALSE, EPERM) == 0)
+		return (0);
+
+	return (EPERM);
+}
+
+/*
+ * Determine if subject can chown owner of a file.
+ */
+int
+secpolicy_vnode_chown(const cred_t *cr, uid_t owner)
+{
+	if (crgetuid(cr) == owner)
+		return (0);
+
+	return (priv_policy(cr, CAP_FOWNER, B_FALSE, EPERM));
+}
+
+/*
+ * Determine if subject can change group ownership of a file.
+ */
+int
+secpolicy_vnode_create_gid(const cred_t *cr)
+{
+	return (priv_policy(cr, CAP_SETGID, B_FALSE, EPERM));
+}
+
+/*
+ * Policy determines whether we can remove an entry from a directory,
+ * regardless of permission bits.
+ */
+int
+secpolicy_vnode_remove(const cred_t *cr)
+{
+	return (priv_policy(cr, CAP_FOWNER, B_FALSE, EPERM));
+}
+
+/*
+ * Determine that subject can modify the mode of a file.  allzone privilege
+ * needed when modifying root owned object.
+ */
+int
+secpolicy_vnode_setdac(const cred_t *cr, uid_t owner)
+{
+	if (crgetuid(cr) == owner)
+		return (0);
+
+	return (priv_policy(cr, CAP_FOWNER, B_FALSE, EPERM));
+}
+
+/*
+ * Are we allowed to retain the set-uid/set-gid bits when
+ * changing ownership or when writing to a file?
+ * "issuid" should be true when set-uid; only in that case
+ * root ownership is checked (setgid is assumed).
+ *
+ * Enforced in the Linux VFS.
+ */
+int
+secpolicy_vnode_setid_retain(const cred_t *cr, boolean_t issuidroot)
+{
+	return (0);
+}
+
+/*
+ * Determine that subject can set the file setgid flag.
+ */
+int
+secpolicy_vnode_setids_setgids(const cred_t *cr, gid_t gid)
+{
+	if (!groupmember(gid, cr))
+		return (priv_policy(cr, CAP_FSETID, B_FALSE, EPERM));
+
+	return (0);
+}
+
+/*
+ * Determine if the subject can inject faults in the ZFS fault injection
+ * framework.  Requires all privileges.
+ */
+int
+secpolicy_zinject(const cred_t *cr)
+{
+	return (priv_policy(cr, CAP_SYS_ADMIN, B_FALSE, EACCES));
+}
+
+/*
+ * Determine if the subject has permission to manipulate ZFS datasets
+ * (not pools).  Equivalent to the SYS_MOUNT privilege.
+ */
+int
+secpolicy_zfs(const cred_t *cr)
+{
+	return (priv_policy(cr, CAP_SYS_ADMIN, B_FALSE, EACCES));
+}
+
+void
+secpolicy_setid_clear(vattr_t *vap, cred_t *cr)
+{
+	if ((vap->va_mode & (S_ISUID | S_ISGID)) != 0 &&
+	    secpolicy_vnode_setid_retain(cr,
+	    (vap->va_mode & S_ISUID) != 0 &&
+	    (vap->va_mask & AT_UID) != 0 && vap->va_uid == 0) != 0) {
+		vap->va_mask |= AT_MODE;
+		vap->va_mode &= ~(S_ISUID|S_ISGID);
+	}
+}
+
+/*
+ * Determine that subject can set the file setid flags.
+ */
+static int
+secpolicy_vnode_setid_modify(const cred_t *cr, uid_t owner)
+{
+	if (crgetuid(cr) == owner)
+		return (0);
+
+	return (priv_policy(cr, CAP_FSETID, B_FALSE, EPERM));
+}
+
+/*
+ * Determine that subject can make a file a "sticky".
+ *
+ * Enforced in the Linux VFS.
+ */
+static int
+secpolicy_vnode_stky_modify(const cred_t *cr)
+{
+	return (0);
+}
+
+int
+secpolicy_setid_setsticky_clear(struct inode *ip, vattr_t *vap,
+    const vattr_t *ovap, cred_t *cr)
+{
+	int error;
+
+	if ((vap->va_mode & S_ISUID) != 0 &&
+	    (error = secpolicy_vnode_setid_modify(cr,
+	    ovap->va_uid)) != 0) {
+		return (error);
+	}
+
+	/*
+	 * Check privilege if attempting to set the
+	 * sticky bit on a non-directory.
+	 */
+	if (!S_ISDIR(ip->i_mode) && (vap->va_mode & S_ISVTX) != 0 &&
+	    secpolicy_vnode_stky_modify(cr) != 0) {
+		vap->va_mode &= ~S_ISVTX;
+	}
+
+	/*
+	 * Check for privilege if attempting to set the
+	 * group-id bit.
+	 */
+	if ((vap->va_mode & S_ISGID) != 0 &&
+	    secpolicy_vnode_setids_setgids(cr, ovap->va_gid) != 0) {
+		vap->va_mode &= ~S_ISGID;
+	}
+
+	return (0);
+}
+
+/*
+ * Check privileges for setting xvattr attributes
+ */
+int
+secpolicy_xvattr(xvattr_t *xvap, uid_t owner, cred_t *cr, vtype_t vtype)
+{
+	return (secpolicy_vnode_chown(cr, owner));
+}
+
+/*
+ * Check privileges for setattr attributes.
+ *
+ * Enforced in the Linux VFS.
+ */
+int
+secpolicy_vnode_setattr(cred_t *cr, struct inode *ip, struct vattr *vap,
+    const struct vattr *ovap, int flags,
+    int unlocked_access(void *, int, cred_t *), void *node)
+{
+	return (0);
+}
+
+/*
+ * Check privileges for links.
+ *
+ * Enforced in the Linux VFS.
+ */
+int
+secpolicy_basic_link(const cred_t *cr)
+{
+	return (0);
+}
diff --git a/module/zfs/zfs_acl.c b/module/zfs/zfs_acl.c
index 47cfd464b164..69a93a8b6aca 100644
--- a/module/zfs/zfs_acl.c
+++ b/module/zfs/zfs_acl.c
@@ -1744,9 +1744,7 @@ zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr,
 	int		error;
 	zfs_sb_t	*zsb = ZTOZSB(dzp);
 	zfs_acl_t	*paclp;
-#ifdef HAVE_KSID
 	gid_t		gid;
-#endif /* HAVE_KSID */
 	boolean_t	need_chmod = B_TRUE;
 	boolean_t	inherited = B_FALSE;
 
@@ -1760,7 +1758,6 @@ zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr,
 
 	acl_ids->z_fuid = vap->va_uid;
 	acl_ids->z_fgid = vap->va_gid;
-#ifdef HAVE_KSID
 	/*
 	 * Determine uid and gid.
 	 */
@@ -1812,7 +1809,6 @@ zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr,
 			}
 		}
 	}
-#endif /* HAVE_KSID */
 
 	/*
 	 * If we're creating a directory, and the parent directory has the
diff --git a/module/zfs/zfs_ctldir.c b/module/zfs/zfs_ctldir.c
index ead58b3984a7..7280fb87283e 100644
--- a/module/zfs/zfs_ctldir.c
+++ b/module/zfs/zfs_ctldir.c
@@ -108,7 +108,7 @@ static krwlock_t zfs_snapshot_lock;
  * Control Directory Tunables (.zfs)
  */
 int zfs_expire_snapshot = ZFSCTL_EXPIRE_SNAPSHOT;
-int zfs_admin_snapshot = 0;
+int zfs_admin_snapshot = 1;
 
 /*
  * Dedicated task queue for unmounting snapshots.
@@ -490,7 +490,7 @@ zfsctl_inode_alloc(zfs_sb_t *zsb, uint64_t id,
 	zp->z_is_stale = B_FALSE;
 	ip->i_generation = 0;
 	ip->i_ino = id;
-	ip->i_mode = (S_IFDIR | S_IRUGO | S_IXUGO);
+	ip->i_mode = (S_IFDIR | S_IRWXUGO);
 	ip->i_uid = SUID_TO_KUID(0);
 	ip->i_gid = SGID_TO_KGID(0);
 	ip->i_blkbits = SPA_MINBLOCKSHIFT;
diff --git a/module/zfs/zfs_fuid.c b/module/zfs/zfs_fuid.c
index 6ca61b87242f..d4916bf5830a 100644
--- a/module/zfs/zfs_fuid.c
+++ b/module/zfs/zfs_fuid.c
@@ -488,7 +488,6 @@ zfs_fuid_node_add(zfs_fuid_info_t **fuidpp, const char *domain, uint32_t rid,
 	}
 }
 
-#ifdef HAVE_KSID
 /*
  * Create a file system FUID, based on information in the users cred
  *
@@ -501,6 +500,7 @@ uint64_t
 zfs_fuid_create_cred(zfs_sb_t *zsb, zfs_fuid_type_t type,
     cred_t *cr, zfs_fuid_info_t **fuidp)
 {
+#ifdef HAVE_KSID
 	uint64_t	idx;
 	ksid_t		*ksid;
 	uint32_t	rid;
@@ -540,8 +540,12 @@ zfs_fuid_create_cred(zfs_sb_t *zsb, zfs_fuid_type_t type,
 	zfs_fuid_node_add(fuidp, kdomain, rid, idx, id, type);
 
 	return (FUID_ENCODE(idx, rid));
-}
+#else
+	VERIFY(type == ZFS_OWNER || type == ZFS_GROUP);
+
+	return ((uint64_t)((type == ZFS_OWNER) ? crgetuid(cr) : crgetgid(cr)));
 #endif /* HAVE_KSID */
+}
 
 /*
  * Create a file system FUID for an ACL ace
diff --git a/scripts/common.sh.in b/scripts/common.sh.in
index 4ce177e3240f..b05614dda16e 100644
--- a/scripts/common.sh.in
+++ b/scripts/common.sh.in
@@ -147,17 +147,6 @@ populate() {
 }
 
 init() {
-	# Disable the udev rule 90-zfs.rules to prevent the zfs module
-	# stack from being loaded due to the detection of a zfs device.
-	# This is important because the test scripts require full control
-	# over when and how the modules are loaded/unloaded.  A trap is
-	# set to ensure the udev rule is correctly replaced on exit.
-	local RULE=${udevruledir}/90-zfs.rules
-	if test -e  ${RULE}; then
-		trap "mv ${RULE}.disabled ${RULE}" INT TERM EXIT
-		mv ${RULE} ${RULE}.disabled
-	fi
-
 	# Create a random directory tree of files and sub-directories to
 	# to act as a copy source for the various regression tests.
 	SRC_DIR=`mktemp -d -p /var/tmp/ zfs.src.XXXXXXXX`
diff --git a/scripts/zconfig.sh b/scripts/zconfig.sh
index 1908dc1d6919..c2b97c2c55e0 100755
--- a/scripts/zconfig.sh
+++ b/scripts/zconfig.sh
@@ -63,6 +63,17 @@ fi
 # Initialize the test suite
 init
 
+# Disable the udev rule 90-zfs.rules to prevent the zfs module
+# stack from being loaded due to the detection of a zfs device.
+# This is important because this test scripts require full control
+# over when and how the modules are loaded/unloaded.  A trap is
+# set to ensure the udev rule is correctly replaced on exit.
+RULE=${udevruledir}/90-zfs.rules
+if test -e  ${RULE}; then
+	trap "mv ${RULE}.disabled ${RULE}" INT TERM EXIT
+	mv ${RULE} ${RULE}.disabled
+fi
+
 # Perform pre-cleanup is requested
 if [ ${CLEANUP} ]; then
 	${ZFS_SH} -u
diff --git a/tests/runfiles/linux.run b/tests/runfiles/linux.run
index 179f82e43dcb..dbb8b5f12d99 100644
--- a/tests/runfiles/linux.run
+++ b/tests/runfiles/linux.run
@@ -346,34 +346,39 @@ tests = ['zpool_status_001_pos', 'zpool_status_002_pos']
 #    'zpool_upgrade_006_neg', 'zpool_upgrade_007_pos', 'zpool_upgrade_008_pos',
 #    'zpool_upgrade_009_neg']
 
-# DISABLED: nested pools
-#[tests/functional/cli_user/misc]
-#tests = ['zdb_001_neg', 'zfs_001_neg', 'zfs_allow_001_neg',
-#    'zfs_clone_001_neg', 'zfs_create_001_neg', 'zfs_destroy_001_neg',
-#    'zfs_get_001_neg', 'zfs_inherit_001_neg', 'zfs_mount_001_neg',
-#    'zfs_promote_001_neg', 'zfs_receive_001_neg', 'zfs_rename_001_neg',
-#    'zfs_rollback_001_neg', 'zfs_send_001_neg', 'zfs_set_001_neg',
-#    'zfs_share_001_neg', 'zfs_snapshot_001_neg', 'zfs_unallow_001_neg',
-#    'zfs_unmount_001_neg', 'zfs_unshare_001_neg', 'zfs_upgrade_001_neg',
-#    'zpool_001_neg', 'zpool_add_001_neg', 'zpool_attach_001_neg',
-#    'zpool_clear_001_neg', 'zpool_create_001_neg', 'zpool_destroy_001_neg',
-#    'zpool_detach_001_neg', 'zpool_export_001_neg', 'zpool_get_001_neg',
-#    'zpool_history_001_neg', 'zpool_import_001_neg', 'zpool_import_002_neg',
-#    'zpool_offline_001_neg', 'zpool_online_001_neg', 'zpool_remove_001_neg',
-#    'zpool_replace_001_neg', 'zpool_scrub_001_neg', 'zpool_set_001_neg',
-#    'zpool_status_001_neg', 'zpool_upgrade_001_neg']
-#user = zfs-tests
+# DISABLED:
+# zfs_share_001_neg - requires additional dependencies
+# zfs_unshare_001_neg - requires additional dependencies
+[tests/functional/cli_user/misc]
+tests = ['zdb_001_neg', 'zfs_001_neg', 'zfs_allow_001_neg',
+    'zfs_clone_001_neg', 'zfs_create_001_neg', 'zfs_destroy_001_neg',
+    'zfs_get_001_neg', 'zfs_inherit_001_neg', 'zfs_mount_001_neg',
+    'zfs_promote_001_neg', 'zfs_receive_001_neg', 'zfs_rename_001_neg',
+    'zfs_rollback_001_neg', 'zfs_send_001_neg', 'zfs_set_001_neg',
+    'zfs_snapshot_001_neg', 'zfs_unallow_001_neg',
+    'zfs_unmount_001_neg', 'zfs_upgrade_001_neg',
+    'zpool_001_neg', 'zpool_add_001_neg', 'zpool_attach_001_neg',
+    'zpool_clear_001_neg', 'zpool_create_001_neg', 'zpool_destroy_001_neg',
+    'zpool_detach_001_neg', 'zpool_export_001_neg', 'zpool_get_001_neg',
+    'zpool_history_001_neg', 'zpool_import_001_neg', 'zpool_import_002_neg',
+    'zpool_offline_001_neg', 'zpool_online_001_neg', 'zpool_remove_001_neg',
+    'zpool_replace_001_neg', 'zpool_scrub_001_neg', 'zpool_set_001_neg',
+    'zpool_status_001_neg', 'zpool_upgrade_001_neg']
+user =
 
 [tests/functional/cli_user/zfs_list]
 tests = ['zfs_list_001_pos', 'zfs_list_002_pos', 'zfs_list_003_pos',
     'zfs_list_004_neg', 'zfs_list_007_pos', 'zfs_list_008_neg']
+user =
 
 [tests/functional/cli_user/zpool_iostat]
 tests = ['zpool_iostat_001_neg', 'zpool_iostat_002_pos',
     'zpool_iostat_003_neg']
+user =
 
 [tests/functional/cli_user/zpool_list]
 tests = ['zpool_list_001_pos', 'zpool_list_002_neg']
+user =
 
 [tests/functional/compression]
 tests = ['compress_001_pos', 'compress_002_pos', 'compress_003_pos',
@@ -382,15 +387,14 @@ tests = ['compress_001_pos', 'compress_002_pos', 'compress_003_pos',
 [tests/functional/ctime]
 tests = ['ctime_001_pos' ]
 
-# DISABLED: Linux does not yet support delegations.
-#[tests/functional/delegate]
-#tests = ['zfs_allow_001_pos', 'zfs_allow_002_pos',
-#    'zfs_allow_004_pos', 'zfs_allow_005_pos', 'zfs_allow_006_pos',
-#    'zfs_allow_007_pos', 'zfs_allow_008_pos', 'zfs_allow_009_neg',
-#    'zfs_allow_010_pos', 'zfs_allow_011_neg', 'zfs_allow_012_neg',
-#    'zfs_unallow_001_pos', 'zfs_unallow_002_pos', 'zfs_unallow_003_pos',
-#    'zfs_unallow_004_pos', 'zfs_unallow_005_pos', 'zfs_unallow_006_pos',
-#    'zfs_unallow_007_neg', 'zfs_unallow_008_neg']
+[tests/functional/delegate]
+tests = ['zfs_allow_001_pos', 'zfs_allow_002_pos',
+    'zfs_allow_004_pos', 'zfs_allow_005_pos', 'zfs_allow_006_pos',
+    'zfs_allow_007_pos', 'zfs_allow_008_pos', 'zfs_allow_009_neg',
+    'zfs_allow_010_pos', 'zfs_allow_011_neg', 'zfs_allow_012_neg',
+    'zfs_unallow_001_pos', 'zfs_unallow_002_pos', 'zfs_unallow_003_pos',
+    'zfs_unallow_004_pos', 'zfs_unallow_005_pos', 'zfs_unallow_006_pos',
+    'zfs_unallow_007_neg', 'zfs_unallow_008_neg']
 
 # DISABLED:
 # devices_001_pos - needs investigation
diff --git a/tests/test-runner/cmd/test-runner.py b/tests/test-runner/cmd/test-runner.py
index dd6a3c7b6724..ad1afff80647 100755
--- a/tests/test-runner/cmd/test-runner.py
+++ b/tests/test-runner/cmd/test-runner.py
@@ -158,6 +158,10 @@ def update_cmd_privs(self, cmd, user):
         me = getpwuid(os.getuid())
 
         if not user or user is me:
+            if os.path.isfile(cmd+'.ksh') and os.access(cmd+'.ksh', os.X_OK):
+                cmd += '.ksh'
+            if os.path.isfile(cmd+'.sh') and os.access(cmd+'.sh', os.X_OK):
+                cmd += '.sh'
             return cmd
 
         if not os.path.isfile(cmd):
@@ -207,10 +211,11 @@ def run(self, options):
         except OSError, e:
             fail('%s' % e)
 
+        self.result.starttime = time()
+        proc = Popen(privcmd, stdout=PIPE, stderr=PIPE)
+        t = Timer(int(self.timeout), self.kill_cmd, [proc])
+
         try:
-            self.result.starttime = time()
-            proc = Popen(privcmd, stdout=PIPE, stderr=PIPE)
-            t = Timer(int(self.timeout), self.kill_cmd, [proc])
             t.start()
             self.result.stdout, self.result.stderr = self.collect_output(proc)
         except KeyboardInterrupt:
diff --git a/tests/zfs-tests/include/libtest.shlib b/tests/zfs-tests/include/libtest.shlib
index 1ac3d0641185..a9236a3bc773 100644
--- a/tests/zfs-tests/include/libtest.shlib
+++ b/tests/zfs-tests/include/libtest.shlib
@@ -1876,6 +1876,14 @@ function add_user #<group_name> <user_name> <basedir>
 
 	log_must $USERADD -g $gname -d $basedir/$uname -m $uname
 
+	# Add new users to the same group and the command line utils.
+	# This allows them to be run out of the original users home
+	# directory as long as it permissioned to be group readable.
+	if is_linux; then
+		cmd_group=$(stat --format="%G" $ZFS)
+		log_must $USERMOD -a -G $cmd_group $uname
+	fi
+
 	return 0
 }
 
@@ -1919,15 +1927,11 @@ function add_group #<group_name>
 	# Assign 100 as the base gid, a larger value is selected for
 	# Linux because for many distributions 1000 and under are reserved.
 	if is_linux; then
-		typeset -i gid=1500
-
 		while true; do
-			$GROUPADD -g $gid $group > /dev/null 2>&1
+			$GROUPADD $group > /dev/null 2>&1
 			typeset -i ret=$?
 			case $ret in
 				0) return 0 ;;
-				# The gid is not  unique
-				9) ((gid += 1)) ;;
 				*) return 1 ;;
 			esac
 		done
@@ -2592,6 +2596,7 @@ function user_run
 	typeset user=$1
 	shift
 
+	log_note "user:$user $@"
 	eval \$SU \$user -c \"$@\" > /tmp/out 2>/tmp/err
 	return $?
 }
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/cleanup.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/cleanup.ksh
index 77090baafbf3..4bb4991103bb 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/cleanup.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/cleanup.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 if poolexists $TESTPOOL.virt
 then
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/misc.cfg b/tests/zfs-tests/tests/functional/cli_user/misc/misc.cfg
index 55d38e824f9b..8054f0ed865b 100644
--- a/tests/zfs-tests/tests/functional/cli_user/misc/misc.cfg
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/misc.cfg
@@ -28,33 +28,59 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-# these are the set of setable ZFS properties
-PROP_NAMES="\
-	aclinherit	aclmode		atime		 \
-	checksum	compression			devices \
-	exec		mountpoint	quota		readonly \
-	recordsize	reservation	setuid		sharenfs \
-	snapdir"
+if is_linux; then
+	# these are the set of setable ZFS properties
+	PROP_NAMES="\
+		aclinherit	acltype		atime		 \
+		checksum	compression			devices \
+		exec		mountpoint	quota		readonly \
+		recordsize	reservation	setuid		 \
+		snapdir"
 
-# these are a set of values we apply, for use when testing the
-# zfs get/set subcommands - ordered as per the list above so we
-# can iterate over both sets in an array
-PROP_VALS="\
-	secure		discard		on		 \
-	fletcher2	on				on \
-	on		legacy		none		on \
-	128k		none		on		on \
-	visible"
+	# these are a set of values we apply, for use when testing the
+	# zfs get/set subcommands - ordered as per the list above so we
+	# can iterate over both sets in an array
+	PROP_VALS="\
+		secure		posixacl	on		 \
+		fletcher2	on				on \
+		on		legacy		none		on \
+		128k		none		on		 \
+		visible"
 
-# these are an alternate set of property values
-PROP_ALTVALS="\
-	noallow		groupmask	off		 \
-	fletcher4	lzjb				off \
-	off		/tmp/zfstest	100m		off \
-	512		10m		off		off \
-	hidden"
+	# these are an alternate set of property values
+	PROP_ALTVALS="\
+		noallow		noacl		off		 \
+		fletcher4	lzjb				off \
+		off		/tmp/zfstest	100m		off \
+		512		10m		off		 \
+		hidden"
+else
+	# these are the set of setable ZFS properties
+	PROP_NAMES="\
+		aclinherit	aclmode		atime		 \
+		checksum	compression			devices \
+		exec		mountpoint	quota		readonly \
+		recordsize	reservation	setuid		sharenfs \
+		snapdir"
 
+	# these are a set of values we apply, for use when testing the
+	# zfs get/set subcommands - ordered as per the list above so we
+	# can iterate over both sets in an array
+	PROP_VALS="\
+		secure		discard		on		 \
+		fletcher2	on				on \
+		on		legacy		none		on \
+		128k		none		on		on \
+		visible"
 
+	# these are an alternate set of property values
+	PROP_ALTVALS="\
+		noallow		noacl		off		 \
+		fletcher4	lzjb				off \
+		off		/tmp/zfstest	100m		off \
+		512		10m		off		off \
+		hidden"
+fi
 
 # additional properties to worry about: canmount copies xattr zoned version
 
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/setup.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/setup.ksh
index e651acb03102..ac5b93472a0b 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/setup.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/setup.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 # This setup script is moderately complex, as it creates scenarios for all
 # of the tests included in this directory. Usually we'd want each test case
@@ -95,7 +95,7 @@ done
 log_must $ZFS create $TESTPOOL/$TESTFS/renameme
 
 
-if is_global_zone
+if is_global_zone && !is_linux
 then
 	# create a filesystem we can share
 	log_must $ZFS create $TESTPOOL/$TESTFS/unshared
@@ -153,7 +153,7 @@ then
 	done
 
 	# copy a v1 pool from cli_root
-	$CP $STF_SUITE/tests/functional/cli_root/zpool_upgrade/blockfiles/zfs-pool-v1.dat.bz2 \
+	$CP $STF_SUITE/tests/functional/cli_root/zpool_upgrade/zfs-pool-v1.dat.bz2 \
 	    /$TESTDIR
 	log_must $BUNZIP2 /$TESTDIR/zfs-pool-v1.dat.bz2
 	log_must $ZPOOL import -d /$TESTDIR v1-pool
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zdb_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zdb_001_neg.ksh
index 876f1e0d2625..4e4276f74a35 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zdb_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zdb_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_001_neg.ksh
index 5edf7350acfc..f055e2bfea5b 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_allow_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_allow_001_neg.ksh
index 0fb22e019714..40f99378b3a6 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_allow_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_allow_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_clone_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_clone_001_neg.ksh
index 406f91305125..ccf5b4db32a9 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_clone_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_clone_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_create_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_create_001_neg.ksh
index 579771e84009..2b5d9bfe31c4 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_create_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_create_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_destroy_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_destroy_001_neg.ksh
index d7a23acedf60..3beb68f6cb68 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_destroy_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_destroy_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_get_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_get_001_neg.ksh
index 70b468117b47..c2d61a28787b 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_get_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_get_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_inherit_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_inherit_001_neg.ksh
index d68cec6e5b45..61b9c878736c 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_inherit_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_inherit_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_mount_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_mount_001_neg.ksh
index ecf356228c13..d324f1c4900c 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_mount_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_mount_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_promote_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_promote_001_neg.ksh
index 579ee9377635..d6b17183be35 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_promote_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_promote_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_receive_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_receive_001_neg.ksh
index 7ea4a47971dd..ae07fef8497e 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_receive_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_receive_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_rename_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_rename_001_neg.ksh
index 20b017fb0e65..118b420512ec 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_rename_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_rename_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_rollback_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_rollback_001_neg.ksh
index ecc95c1313ff..02f3422b6a33 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_rollback_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_rollback_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_send_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_send_001_neg.ksh
index 0b92ed355b13..0e3af1291377 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_send_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_send_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_set_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_set_001_neg.ksh
index 1f1a8bdc5f48..9f1c57cd83ea 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_set_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_set_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_share_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_share_001_neg.ksh
index 0f45f507f5a2..4127234ee997 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_share_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_share_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_snapshot_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_snapshot_001_neg.ksh
index f473c5e83ce7..88183b14098b 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_snapshot_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_snapshot_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unallow_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unallow_001_neg.ksh
index 84dc9387085e..106e0f87c128 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unallow_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unallow_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unmount_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unmount_001_neg.ksh
index 22a3d75e0797..e0c703f900c1 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unmount_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unmount_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unshare_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unshare_001_neg.ksh
index 069279cad84d..4849244d84a8 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unshare_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_unshare_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_upgrade_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_upgrade_001_neg.ksh
index 0053871dc288..290827d14f3b 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zfs_upgrade_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zfs_upgrade_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_001_neg.ksh
index 447fc9705b87..e4512bc493e6 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_add_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_add_001_neg.ksh
index d02dd0b9e3bf..9858f2884961 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_add_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_add_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
@@ -50,13 +50,21 @@ ADD_DISK="${ADD_DISK##* }"
 [[ -z $ADD_DISK ]] && \
         log_fail "No spare disks available."
 
-set -A args "add" "add -f" "add -n" \
-    "add $TESTPOOL" "add -f $TESTPOOL" "add -n $TESTPOOL" \
-    "add -fn $TESTPOOL" "add -nf $TESTPOOL" \
-    "add $TESTPOOL $ADD_DISK" "add -f $TESTPOOL $ADD_DISK" \
-    "add -n $TESTPOOL $ADD_DISK" \
-    "add -fn $TESTPOOL $ADD_DISK" \
-    "add -nf $TESTPOOL $ADD_DISK" \
+# Under Linux dry-run commands have no legitimate reason to fail.
+if is_linux; then
+	set -A args "add" "add -f" "add -n" \
+	    "add $TESTPOOL" "add -f $TESTPOOL" "add -n $TESTPOOL" \
+	    "add -fn $TESTPOOL" "add -nf $TESTPOOL" \
+	    "add $TESTPOOL $ADD_DISK" "add -f $TESTPOOL $ADD_DISK"
+else
+	set -A args "add" "add -f" "add -n" \
+	    "add $TESTPOOL" "add -f $TESTPOOL" "add -n $TESTPOOL" \
+	    "add -fn $TESTPOOL" "add -nf $TESTPOOL" \
+	    "add $TESTPOOL $ADD_DISK" "add -f $TESTPOOL $ADD_DISK" \
+	    "add -n $TESTPOOL $ADD_DISK" \
+	    "add -fn $TESTPOOL $ADD_DISK" \
+	    "add -nf $TESTPOOL $ADD_DISK"
+fi
 
 log_assert "zpool add [-fn] pool_name vdev"
 
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_attach_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_attach_001_neg.ksh
index 59254ea459ae..e1d883d28b6d 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_attach_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_attach_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_clear_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_clear_001_neg.ksh
index 0a6bb8c0b370..0100bed1cc42 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_clear_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_clear_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_create_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_create_001_neg.ksh
index f77df30a0918..592c51a10058 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_create_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_create_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
@@ -50,13 +50,21 @@ ADD_DISK="${ADD_DISK##* }"
 [[ -z $ADD_DISK ]] && \
         log_fail "No spare disks available."
 
-set -A args "create" "create -f" "create -n" \
-    "create $TESTPOOL" "create -f $TESTPOOL" "create -n $TESTPOOL" \
-    "create -fn $TESTPOOL" "create -nf $TESTPOOL" \
-    "create $TESTPOOL $ADD_DISK" "create -f $TESTPOOL $ADD_DISK" \
-    "create -n $TESTPOOL $ADD_DISK" \
-    "create -fn $TESTPOOL $ADD_DISK" \
-    "create -nf $TESTPOOL $ADD_DISK"
+# Under Linux dry-run commands have no legitimate reason to fail.
+if is_linux; then
+	set -A args "create" "create -f" "create -n" \
+	    "create $TESTPOOL" "create -f $TESTPOOL" "create -n $TESTPOOL" \
+	    "create -fn $TESTPOOL" "create -nf $TESTPOOL" \
+	    "create $TESTPOOL $ADD_DISK" "create -f $TESTPOOL $ADD_DISK"
+else
+	set -A args "create" "create -f" "create -n" \
+	    "create $TESTPOOL" "create -f $TESTPOOL" "create -n $TESTPOOL" \
+	    "create -fn $TESTPOOL" "create -nf $TESTPOOL" \
+	    "create $TESTPOOL $ADD_DISK" "create -f $TESTPOOL $ADD_DISK" \
+	    "create -n $TESTPOOL $ADD_DISK" \
+	    "create -fn $TESTPOOL $ADD_DISK" \
+	    "create -nf $TESTPOOL $ADD_DISK"
+fi
 
 log_assert "zpool create [-fn] pool_name vdev"
 
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_destroy_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_destroy_001_neg.ksh
index 8d28f7093591..4deb2281a2f7 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_destroy_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_destroy_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_detach_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_detach_001_neg.ksh
index 849308dd666c..c5e8ab12b054 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_detach_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_detach_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_export_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_export_001_neg.ksh
index 6d44be7227b5..49151909fcec 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_export_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_export_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_get_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_get_001_neg.ksh
index 6965a58bd577..697ec6ea5c1e 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_get_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_get_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_history_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_history_001_neg.ksh
index b29d083ac038..9a304b7e6fc2 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_history_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_history_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_import_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_import_001_neg.ksh
index c73c12f482c8..b15a451ff9a0 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_import_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_import_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_import_002_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_import_002_neg.ksh
index 011cd1c0301e..dfcef4dd19db 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_import_002_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_import_002_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_offline_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_offline_001_neg.ksh
index 6fa03c4272ef..952c921fe8f1 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_offline_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_offline_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_online_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_online_001_neg.ksh
index db886eb73044..36d3aef3a0dc 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_online_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_online_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_remove_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_remove_001_neg.ksh
index 7e93bc0a4663..38acd5f4d641 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_remove_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_remove_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_replace_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_replace_001_neg.ksh
index 12576bf03e3d..b933d41954a8 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_replace_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_replace_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_scrub_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_scrub_001_neg.ksh
index abbdcd6ca201..ddc06f88f8bf 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_scrub_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_scrub_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_set_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_set_001_neg.ksh
index e353d2dd8cec..bcf3a908a5f5 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_set_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_set_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_status_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_status_001_neg.ksh
index 54806b50af42..42111a6a1dae 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_status_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_status_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_upgrade_001_neg.ksh b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_upgrade_001_neg.ksh
index 2dc02b7f69dd..02c33ca152c4 100755
--- a/tests/zfs-tests/tests/functional/cli_user/misc/zpool_upgrade_001_neg.ksh
+++ b/tests/zfs-tests/tests/functional/cli_user/misc/zpool_upgrade_001_neg.ksh
@@ -29,8 +29,8 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
-. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 . $STF_SUITE/include/libtest.shlib
+. $STF_SUITE/tests/functional/cli_user/misc/misc.cfg
 
 #
 # DESCRIPTION:
diff --git a/tests/zfs-tests/tests/functional/delegate/cleanup.ksh b/tests/zfs-tests/tests/functional/delegate/cleanup.ksh
index c0a3e34d642c..e14979d6540e 100755
--- a/tests/zfs-tests/tests/functional/delegate/cleanup.ksh
+++ b/tests/zfs-tests/tests/functional/delegate/cleanup.ksh
@@ -29,14 +29,17 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
+. $STF_SUITE/include/libtest.shlib
 . $STF_SUITE/tests/functional/delegate/delegate_common.kshlib
 
 cleanup_user_group
 
-# restore the state of svc:/network/nis/client:default
-if [[ -e $NISSTAFILE ]]; then
-	log_must $SVCADM enable svc:/network/nis/client:default
-	log_must $RM -f $NISSTAFILE
+if ! is_linux; then
+	# restore the state of svc:/network/nis/client:default
+	if [[ -e $NISSTAFILE ]]; then
+		log_must $SVCADM enable svc:/network/nis/client:default
+		log_must $RM -f $NISSTAFILE
+	fi
 fi
 
 default_cleanup
diff --git a/tests/zfs-tests/tests/functional/delegate/delegate_common.kshlib b/tests/zfs-tests/tests/functional/delegate/delegate_common.kshlib
index d4b773335524..56a9fe6468bb 100644
--- a/tests/zfs-tests/tests/functional/delegate/delegate_common.kshlib
+++ b/tests/zfs-tests/tests/functional/delegate/delegate_common.kshlib
@@ -63,6 +63,7 @@ function restore_root_datasets
 			log_must $ZFS destroy -Rf $ROOT_TESTVOL
 		fi
 		log_must $ZFS create -V $VOLSIZE $ROOT_TESTVOL
+		block_device_wait
 	fi
 
 	return 0
@@ -101,6 +102,7 @@ function verify_perm
 				ret=$?
 			fi
 
+			log_note "Check $type $user $perm $dtst"
 			if ((ret != 0)) ; then
 				log_note "Fail: $user should have $perm " \
 					"on $dtst"
@@ -415,6 +417,7 @@ function verify_fs_receive
 	typeset datasets="$newfs"
 	if is_global_zone ; then
 		log_must $ZFS create -V $VOLSIZE $newvol
+		block_device_wait
 		datasets="$newfs $newvol"
 	fi
 
@@ -581,12 +584,14 @@ function verify_fs_create
 	if is_global_zone ; then
 		# mount permission is required for sparse volume
 		user_run $user $ZFS create -V 150m -s $newvol
+		block_device_wait
 		if datasetexists $newvol ; then
 			return 1
 		fi
 
 		log_must $ZFS allow $user mount $fs
 		user_run $user $ZFS create -V 150m -s $newvol
+		block_device_wait
 		log_must $ZFS unallow $user mount $fs
 		if ! datasetexists $newvol ; then
 			return 1
@@ -596,12 +601,14 @@ function verify_fs_create
 		# mount and reserveration permission are
 		# required for normal volume
 		user_run $user $ZFS create -V 150m $newvol
+		block_device_wait
 		if datasetexists $newvol ; then
 			return 1
 		fi
 
 		log_must $ZFS allow $user mount $fs
 		user_run $user $ZFS create -V 150m $newvol
+		block_device_wait
 		log_must $ZFS unallow $user mount $fs
 		if datasetexists $newvol ; then
 			return 1
@@ -609,6 +616,7 @@ function verify_fs_create
 
 		log_must $ZFS allow $user reservation $fs
 		user_run $user $ZFS create -V 150m $newvol
+		block_device_wait
 		log_must $ZFS unallow $user reservation $fs
 		if datasetexists $newvol ; then
 			return 1
@@ -616,6 +624,7 @@ function verify_fs_create
 
 		log_must $ZFS allow $user refreservation $fs
 		user_run $user $ZFS create -V 150m $newvol
+		block_device_wait
 		log_must $ZFS unallow $user refreservation $fs
 		if datasetexists $newvol ; then
 			return 1
@@ -625,6 +634,7 @@ function verify_fs_create
 		log_must $ZFS allow $user reservation $fs
 		log_must $ZFS allow $user refreservation $fs
 		user_run $user $ZFS create -V 150m $newvol
+		block_device_wait
 		log_must $ZFS unallow $user mount $fs
 		log_must $ZFS unallow $user reservation $fs
 		log_must $ZFS unallow $user refreservation $fs
diff --git a/tests/zfs-tests/tests/functional/delegate/setup.ksh b/tests/zfs-tests/tests/functional/delegate/setup.ksh
index 0e4a9ec29472..6533f27cb9c3 100755
--- a/tests/zfs-tests/tests/functional/delegate/setup.ksh
+++ b/tests/zfs-tests/tests/functional/delegate/setup.ksh
@@ -29,15 +29,18 @@
 # Copyright (c) 2013 by Delphix. All rights reserved.
 #
 
+. $STF_SUITE/include/libtest.shlib
 . $STF_SUITE/tests/functional/delegate/delegate_common.kshlib
 
-# check svc:/network/nis/client:default state
-# disable it if the state is ON
-# and the state will be restored during cleanup.ksh
-log_must $RM -f $NISSTAFILE
-if [[ "ON" == $($SVCS -H -o sta svc:/network/nis/client:default) ]]; then
-	log_must $SVCADM disable -t svc:/network/nis/client:default
-	log_must $TOUCH $NISSTAFILE
+if ! is_linux; then
+	# check svc:/network/nis/client:default state
+	# disable it if the state is ON
+	# and the state will be restored during cleanup.ksh
+	log_must $RM -f $NISSTAFILE
+	if [[ "ON" == $($SVCS -H -o sta svc:/network/nis/client:default) ]]; then
+		log_must $SVCADM disable -t svc:/network/nis/client:default
+		log_must $TOUCH $NISSTAFILE
+	fi
 fi
 
 cleanup_user_group
diff --git a/tests/zfs-tests/tests/functional/delegate/zfs_allow_001_pos.ksh b/tests/zfs-tests/tests/functional/delegate/zfs_allow_001_pos.ksh
index 32b1a8841a34..14a3bc10e30f 100755
--- a/tests/zfs-tests/tests/functional/delegate/zfs_allow_001_pos.ksh
+++ b/tests/zfs-tests/tests/functional/delegate/zfs_allow_001_pos.ksh
@@ -67,7 +67,7 @@ typeset perms="snapshot,reservation,compression,checksum,send,userprop"
 log_note "Create a user called 'everyone'."
 if ! $ID everyone > /dev/null 2>&1; then
 	user_added="TRUE"
-	log_must $USERADD everyone
+	log_must add_user $STAFF_GROUP everyone
 fi
 for dtst in $DATASETS ; do
 	log_must $ZFS allow everyone $perms $dtst
@@ -75,7 +75,7 @@ for dtst in $DATASETS ; do
 done
 log_must restore_root_datasets
 if [[ $user_added == "TRUE" ]]; then
-	log_must $USERDEL everyone
+	log_must del_user everyone
 fi
 
 log_note "Created a group called 'everyone'."
diff --git a/tests/zfs-tests/tests/functional/delegate/zfs_allow_002_pos.ksh b/tests/zfs-tests/tests/functional/delegate/zfs_allow_002_pos.ksh
index 2da435eec385..e11051adfe31 100755
--- a/tests/zfs-tests/tests/functional/delegate/zfs_allow_002_pos.ksh
+++ b/tests/zfs-tests/tests/functional/delegate/zfs_allow_002_pos.ksh
@@ -61,7 +61,7 @@ log_onexit cleanup
 eval set -A dataset $DATASETS
 typeset perms="snapshot,reservation,compression,checksum,send,userprop"
 
-log_must $USERADD $STAFF_GROUP
+log_must add_user $STAFF_GROUP $STAFF_GROUP
 for dtst in $DATASETS ; do
 	log_must $ZFS allow $STAFF_GROUP $perms $dtst
 	log_must verify_perm $dtst $perms $STAFF_GROUP
diff --git a/tests/zfs-tests/tests/functional/delegate/zfs_allow_010_pos.ksh b/tests/zfs-tests/tests/functional/delegate/zfs_allow_010_pos.ksh
index 397b1a568ffc..9f00376f2eeb 100755
--- a/tests/zfs-tests/tests/functional/delegate/zfs_allow_010_pos.ksh
+++ b/tests/zfs-tests/tests/functional/delegate/zfs_allow_010_pos.ksh
@@ -48,10 +48,43 @@ log_assert "Verify privileged user has correct permissions once which was "\
 	"delegated to him in datasets"
 log_onexit restore_root_datasets
 
+if is_linux; then
 #
 #				Results in	Results in
 #		Permission	Filesystem	Volume
 #
+# Removed for Linux:
+# - mount	- mount(8) does not permit non-superuser mounts
+# - mountpoint	- mount(8) does not permit non-superuser mounts
+# - canmount	- mount(8) does not permit non-superuser mounts
+# - rename      - mount(8) does not permit non-superuser mounts
+# - zoned	- zones are not supported
+# - destroy     - umount(8) does not permit non-superuser umounts
+#
+set -A perms	create		true		false	\
+		snapshot	true		true	\
+		send		true		true	\
+		allow		true		true	\
+		quota		true		false	\
+		reservation	true		true	\
+		recordsize	true		false	\
+		checksum	true		true	\
+		compression	true		true	\
+		atime		true		false	\
+		devices		true		false	\
+		exec		true		false	\
+		volsize		false		true	\
+		setuid		true		false	\
+		readonly	true		true	\
+		snapdir		true		false	\
+		userprop	true		true	\
+		aclinherit	true		false	\
+		rollback	true		true	\
+		clone		true		true	\
+		promote		true		true	\
+		xattr		true		false	\
+		receive		true		false	\
+else
 set -A perms	create		true		false	\
 		snapshot	true		true	\
 		mount		true		false	\
@@ -72,7 +105,6 @@ set -A perms	create		true		false	\
 		readonly	true		true	\
 		snapdir		true		false	\
 		userprop	true		true	\
-		aclmode		true		false	\
 		aclinherit	true		false	\
 		rollback	true		true	\
 		clone		true		true	\
@@ -82,6 +114,8 @@ set -A perms	create		true		false	\
 		xattr		true		false	\
 		receive		true		false	\
 		destroy		true		true
+fi
+
 if is_global_zone; then
 	typeset -i n=${#perms[@]}
 	perms[((n))]="sharenfs"; perms[((n+1))]="true"; perms[((n+2))]="false"
diff --git a/tests/zfs-tests/tests/functional/delegate/zfs_allow_012_neg.ksh b/tests/zfs-tests/tests/functional/delegate/zfs_allow_012_neg.ksh
index c33c29b99e39..a64561b692d3 100755
--- a/tests/zfs-tests/tests/functional/delegate/zfs_allow_012_neg.ksh
+++ b/tests/zfs-tests/tests/functional/delegate/zfs_allow_012_neg.ksh
@@ -55,11 +55,19 @@ log_assert "Verify privileged user can not use permissions properly when " \
 log_onexit cleanup
 
 
+if is_linux; then
+set -A perms	create snapshot mount send allow quota reservation \
+		recordsize mountpoint checksum compression canmount atime \
+		devices exec volsize setuid readonly snapdir userprop \
+		rollback clone rename promote \
+		zoned xattr receive destroy
+else
 set -A perms	create snapshot mount send allow quota reservation \
 		recordsize mountpoint checksum compression canmount atime \
 		devices exec volsize setuid readonly snapdir userprop \
 		aclmode aclinherit rollback clone rename promote \
 		zoned xattr receive destroy sharenfs share
+fi
 
 log_must $ZPOOL set delegation=off $TESTPOOL
 
diff --git a/udev/rules.d/90-zfs.rules.in b/udev/rules.d/90-zfs.rules.in
index a2715d2e7814..855c154040f5 100644
--- a/udev/rules.d/90-zfs.rules.in
+++ b/udev/rules.d/90-zfs.rules.in
@@ -7,6 +7,6 @@ ENV{ID_FS_TYPE}=="zfs_member", RUN+="/sbin/modprobe zfs"
 KERNEL=="null", SYMLINK+="root"
 SYMLINK=="null", SYMLINK+="root"
 
-SUBSYSTEM=="misc", KERNEL=="zfs", RUN+="@sbindir@/zpool list"
+SUBSYSTEM=="misc", KERNEL=="zfs", MODE="0666"
 
 LABEL="zfs_end"