It also appears that sanlock needs AT LEAST rw permissions on the group as rx breaks it per logs.