From 50e0060091e008ad93fcfbb68cbbb81da5dec067 Mon Sep 17 00:00:00 2001 From: Richard Sharpe Date: Tue, 2 Apr 2013 06:48:03 -0700 Subject: Add a comment about why we are removing the INHERITED bit so people understand. Signed-off-by: Richard Sharpe Reviewed-by: Andreas Schneider Autobuild-User(master): Andreas Schneider Autobuild-Date(master): Tue Apr 2 20:05:13 CEST 2013 on sn-devel-104 --- libcli/security/secdesc.c | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'libcli/security') diff --git a/libcli/security/secdesc.c b/libcli/security/secdesc.c index a7e99005eb..8570334f36 100644 --- a/libcli/security/secdesc.c +++ b/libcli/security/secdesc.c @@ -614,6 +614,15 @@ NTSTATUS se_create_child_secdesc(TALLOC_CTX *ctx, if (!container) { new_flags = 0; } else { + /* + * We need to remove SEC_ACE_FLAG_INHERITED_ACE here + * if present because it should only be set if the + * parent has the AUTO_INHERITED bit set in the + * type/control field. If we don't it will slip through + * and create DACLs with incorrectly ordered ACEs + * when there are CREATOR_OWNER or CREATOR_GROUP + * ACEs. + */ new_flags &= ~(SEC_ACE_FLAG_INHERIT_ONLY | SEC_ACE_FLAG_INHERITED_ACE); -- cgit