<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.5pt;
font-family:Consolas;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:Consolas;}
p.code, li.code, div.code
{mso-style-name:code;
margin-top:0in;
margin-right:0in;
margin-bottom:1.0pt;
margin-left:.15in;
font-size:11.0pt;
font-family:"Courier New";
color:black;}
p.code0, li.code0, div.code0
{mso-style-name:code0;
margin-top:0in;
margin-right:0in;
margin-bottom:1.0pt;
margin-left:.15in;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.plaintextchar0
{mso-style-name:plaintextchar;
mso-style-priority:99;
font-family:Consolas;}
span.plaintextchar00
{mso-style-name:plaintextchar0;
mso-style-priority:99;
font-family:Consolas;}
span.codechar
{mso-style-name:codechar;
font-family:"Courier New";
color:black;}
span.codechar0
{mso-style-name:codechar0;
font-family:"Courier New";
color:black;}
span.EmailStyle26
{mso-style-type:personal;
font-family:"Arial","sans-serif";
color:navy;}
span.EmailStyle27
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle28
{mso-style-type:personal;
font-family:"Arial","sans-serif";
color:navy;}
span.EmailStyle29
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Hi Nadezhda,<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Thanks for your new question. One
of my colleagues will contact you soon (if not already done), and will be working
with you to address this inquiry.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<div>
<p class=MsoNormal><span style='color:#1F497D'>Best regards,<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='page-break-after:avoid'><span style='font-family:
"Cambria","serif";color:#1F497D'>Edgar</span><span style='color:#1F497D'><br>
<br>
</span><span style='font-size:9.0pt;color:#1F497D'><o:p></o:p></span></p>
</div>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Nadezhda Ivanova
[mailto:nadezhda.ivanova@postpath.com] <br>
<b>Sent:</b> Monday, August 10, 2009 4:48 AM<br>
<b>To:</b> Edgar Olougouna<br>
<b>Cc:</b> pfif@tridgell.net; cifs-protocol@samba.org<br>
<b>Subject:</b> RE: Information needed about security token default ACL<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:navy'>Hi Edgar,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:navy'>What about replacement of SID placeholders such as CREATOR_OWNER
and PRINCIPAL_SELF in a defaultSecurityDescriptor? These are actually replaced
with the SID of the authenticated user and the SID of the new security
principal, respectively. So some processing of the default occurs during object
creation in AD. I apologize for being so picky, but I think we should clear all
such issues. My initial question of what parameter we use to pass defaultSecurityDescriptor
has been answered. Now it would appear that we also may need to pass some
routine for pre-processing it (replacing holders for example). Is this the
case?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:navy'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:navy'>Regards,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:navy'>Nadezhda Ivanova<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:navy'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div class=MsoNormal align=center style='text-align:center'><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'>
<hr size=2 width="100%" align=center>
</span></div>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Edgar Olougouna
[mailto:edgaro@microsoft.com] <br>
<b>Sent:</b> Saturday, August 08, 2009 12:18 AM<br>
<b>To:</b> Nadezhda Ivanova<br>
<b>Cc:</b> pfif@tridgell.net; cifs-protocol@samba.org<br>
<b>Subject:</b> RE: Information needed about security token default ACL</span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Hi Nadezhda,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>After further review, it has been determined that the
defaultSecurityDescriptor should be used as it is in a scenario where its usage
is permissible. <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>I have prepared a set of questions and answers to explain how we
address the issues you rose.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Questions and answers<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>==================<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Question: <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Will the issue of DEFAULT_DESCRIPTOR_FOR_OBJECT usage be clarified
in the updated MS-ADTS?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Answer:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>The proposed procedure in this communication covers inheritable
ACEs in general, i.e. object-specific inheritable ACEs and generic inheritable
ACEs.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Your previous feedback related to the
DEFAULT_DESCRIPTOR_FOR_OBJECT was based on the assumption that the defaultSecurityDescriptor
is passed as CreatorDescriptor argument in ComputeACL algorithm, which is not
the case as we clarify in the revised procedure. <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Question: <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>When can we expect the document update to be available?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Answer:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>The product team is working to update the MS-ADTS document to
reflect the defaulting rules related to defaultSecurityDescriptor when
assigning security descriptors to AD objects. The changes will be available in
a future version of the document.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif"'>Question:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif"'>In
Windows 2008 Active Directory, why the security descriptor of a domain-dns
object is identical to the defaultSecurityDescriptor of its classSchema object?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Answer:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>The example of a root of a NC is illustrative of a usage of
defaultSecurityDescriptor. However it is also an exception case and the
security descriptor of the root of a NC does not include any inherited ACEs.
Active directory objects have some specific requirements as detailed in
[MS-ADTS] 7.1.3 Security Descriptor Requirements </span><a
href="http://msdn.microsoft.com/en-us/library/cc223731(PROT.13).aspx"><span
style='font-family:"Times New Roman","serif"'>http://msdn.microsoft.com/en-us/library/cc223731(PROT.13).aspx</span></a><span
style='font-family:"Times New Roman","serif";color:#1F497D'>.</span><span
style='font-family:"Times New Roman","serif";color:black'><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Question:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>I had a look at defaultSecurityDescriptor attributes in some
classSchema objects. There is no ACE-flag set on them. Does this means the ACEs
would not be inherited? <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Answer:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>This is not an issue since we now use the
defaultSecurityDescriptor when the scenario requires, instead of calling the
ComputeInheritedACLFromParent method with the ACEs extracted from
defaultSecurityDescriptor.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Question:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>If we must call ComputeInheritedACLFromParent with ACEs from
defaultSecurityDescriptor as ParentACL, does that mean that
CreateSecurityDescriptor must have another argument to allow passing of the
defaultSecurityDescriptor?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Answer:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Even though ComputeInheritedACLFromParent is not being called
anymore, defaultSecurityDescriptor will be an extra parameter that needs to be
passed to the CreateSecurityDescriptor method. <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Question:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>If the ACEs cannot be inherited from defaultSecurityDescriptor,
shouldn’t we just use the ACEs from the defaultSecurityDescriptor as opposed to
calling ComputeInheritedACLFromParent with ACEs from defaultSecurityDescriptor
as ParentACL?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Answer:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>This is the correct approach, using the defaultSecurityDescriptor
without calling ComputeInheritedACLFromParent.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>Revised procedure<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:black'>==============<o:p></o:p></span></p>
<p class=MsoNormal><b><span style='color:#1F497D'><o:p> </o:p></span></b></p>
<p class=MsoNormal><b><span style='color:#1F497D'>Condition 1 : Parent contains
inheritable ACEs<o:p></o:p></span></b></p>
<p class=MsoListParagraph><span style='color:#1F497D'>Step 1. If the
control flags on the client allow inheritance then the inheritable ACEs from
the parent form the newly created object’s initial DACL and SACL <o:p></o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'>Step 2. If the
control flags on the client do not allow inheritance, set initial DACL and SACL
to NULL<o:p></o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'>Step 3. If an
explicit security descriptor is provided by the client, that is merged with the
initial DACL and SACL.<o:p></o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'>Step 4. If an
explicit security descriptor is not provided by the client then the DACL and
SACL from the defaultSecurityDescriptor are merged with the initial DACL and
SACL. <o:p></o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'>In ComputeACL method
[MS-DTYP] section 2.5.2.4 defaultSecurityDescriptor is used in the highlighted
areas :<o:p></o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=code0>Set ComputedACL to NULL<o:p></o:p></p>
<p class=code0>Set ComputedControl to NULL<o:p></o:p></p>
<p class=code0><o:p> </o:p></p>
<p class=code0>CALL ContainsInheritableACEs WITH ParentACL RETURNING result<o:p></o:p></p>
<p class=code0><o:p> </o:p></p>
<p class=code0>IF result = TRUE THEN<o:p></o:p></p>
<p class=code0> // ParentACL contains inheritable ACEs<o:p></o:p></p>
<p class=code0> <span style='color:windowtext'>IF(CreatorACL
is not present) OR<o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'>
((CreatorACL is present) AND<o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'>
(AutoInheritFlags contains DEFAULT_DESCRIPTOR))<o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'> THEN<o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'>
// Use only the inherited ACEs from the parent<o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'>
CALL ComputeInheritedACLFromParent WITH<o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'>
ParentACL, IsContainerObject, ObjectTypes<o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'>
RETURNING NextACL<o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'>
CALL PostProcessACL WITH<o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'>
NextACL, Owner, Group, GenericMapping<o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'>
RETURNING FinalACL<o:p></o:p></span></p>
<p class=code0><span style='font-size:12.0pt;font-family:"Calibri","sans-serif";
color:windowtext'> <span
style='background:yellow'>Here the defaultSecurityDescriptor should be merged
with the FinalACL above. That will be the new resultant FinalACL</span><o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'>
Set ComputedACL to FinalACL</span><span style='font-size:8.0pt;color:windowtext'><o:p></o:p></span></p>
<p class=code0><span style='color:windowtext'> ENDIF<o:p></o:p></span></p>
<p class=code0><span style='font-size:11.0pt'><o:p> </o:p></span></p>
<p class=code0> IF ((CreatorACL is present) AND<o:p></o:p></p>
<p class=code0> (AutoInheritFlags does not
contain DEFAULT_DESCRIPTOR))<o:p></o:p></p>
<p class=code0> THEN<o:p></o:p></p>
<p class=code0> CALL
PreProcessACLFromCreator WITH CreatorACL<o:p></o:p></p>
<p class=code0> RETURNING PreACL<o:p></o:p></p>
<p class=code0><o:p> </o:p></p>
<p class=code0> CALL
ComputeInheritedACLFromCreator WITH<o:p></o:p></p>
<p class=code0> PreACL,
IsContainerObject, ObjectTypes<o:p></o:p></p>
<p class=code0> RETURNING TmpACL<o:p></o:p></p>
<p class=code0><o:p> </o:p></p>
<p class=code0> IF((ComputeType =
DACL_COMPUTE) AND<o:p></o:p></p>
<p class=code0>
(CreatorControl does not contain DACL_PROTECTED) AND<o:p></o:p></p>
<p class=code0> (AutoInheritFlags
contains DACL_AUTO_INHERIT flag))<o:p></o:p></p>
<p class=code0> THEN<o:p></o:p></p>
<p class=code0>
// Compute the inherited ACEs from the parent<o:p></o:p></p>
<p class=code0>
CALL ComputeInheritedACLFromParent WITH<o:p></o:p></p>
<p class=code0>
ParentACL, IsContainerObject, ObjectTypes<o:p></o:p></p>
<p class=code0>
RETURNING ParentACL<o:p></o:p></p>
<p class=code0>
Append ParentACL.ACEs to TmpACL.ACEs<o:p></o:p></p>
<p class=code0>
Add DACL_AUTO_INHERITED to ComputedControl<o:p></o:p></p>
<p class=code0> ELSE <o:p></o:p></p>
<p class=code0>
IF ((ComputeType = SACL_COMPUTE) AND<o:p></o:p></p>
<p class=code0>
(CreatorControl does not contain SACL_PROTECTED) AND<o:p></o:p></p>
<p class=code0>
(AutoInheritFlags contains SACL_AUTO_INHERIT flag))<o:p></o:p></p>
<p class=code0>
THEN<o:p></o:p></p>
<p class=code0>
// Compute the inherited ACEs from the parent<o:p></o:p></p>
<p class=code0>
CALL ComputeInheritedACLFromParent WITH<o:p></o:p></p>
<p class=code0>
ParentACL,
IsContainerObject, ObjectTypes<o:p></o:p></p>
<p class=code0>
RETURNING ParentACL<o:p></o:p></p>
<p class=code0>
Append ParentACL.ACEs to TmpACL.ACEs<o:p></o:p></p>
<p class=code0>
Add SACL_AUTO_INHERITED to ComputedControl<o:p></o:p></p>
<p class=code0>
ENDIF<o:p></o:p></p>
<p class=code0> ENDIF<o:p></o:p></p>
<p class=code0> ENDIF<o:p></o:p></p>
<p class=code0><o:p> </o:p></p>
<p class=code0><span style='font-size:12.0pt;font-family:"Calibri","sans-serif"'>
<span style='background:yellow'>If (CREATORACL is absent)<o:p></o:p></span></span></p>
<p class=code0><span style='font-size:12.0pt;font-family:"Calibri","sans-serif";
background:yellow'> Here ACLs should
be obtained from the parent and be merged with those from the
defaultSecurityDescriptor. <o:p></o:p></span></p>
<p class=code0><span style='font-size:12.0pt;font-family:"Calibri","sans-serif";
background:yellow'> ENDIF</span><span style='font-size:12.0pt;
font-family:"Calibri","sans-serif"'><o:p></o:p></span></p>
<p class=code0><span style='font-size:8.0pt'><o:p> </o:p></span></p>
<p class=code0> CALL PostProcessACL WITH<o:p></o:p></p>
<p class=code0> TmpACL, Owner, Group,
GenericMapping<span style='font-size:11.0pt'><o:p></o:p></span></p>
<p class=code0> RETURNING ProcessedACL<o:p></o:p></p>
<p class=code0><o:p> </o:p></p>
<p class=code0> Set ComputedACL to ProcessedACL<o:p></o:p></p>
<p class=code0><o:p> </o:p></p>
<p class=code0>ELSE // ParentACL does not contain inheritable ACEs<o:p></o:p></p>
<p class=MsoListParagraph><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><b><span style='color:#1F497D'>Condition 2 : Parent does not
contain inheritable ACEs<o:p></o:p></span></b></p>
<p class=MsoNormal><span style='color:#1F497D'>
If the parentACL does not contain inheritable ACEs and no explicit security
descriptor has been provided for the newly created object then check to see if
a defaultSecurityDescriptor for the objectClass under consideration is present.
<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>
At this stage :<o:p></o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'>ELSE // ParentACL does not contain inheritable ACEs<o:p></o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'>IF CreatorACL = NULL THEN<o:p></o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> // No ACL supplied
for the object<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>
if the defaultSecurityDescriptor is present then that will form the newly
created object’s security descriptor.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>In this case the security
information in the token need not be used. <o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><b><span style='color:#1F497D'>Condition 3 : Parent does not
contain inheritable ACEs AND defaultSecurityDescriptor for the particular
object is absent<o:p></o:p></span></b></p>
<p class=MsoNormal><span style='color:#1F497D'>If the defaultSecurityDescriptor
of the particular objectClass under consideration is <b>absent</b> then make
use of Token as described in the ComputeACL method.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'>ELSE // ParentACL does not contain inheritable ACEs<o:p></o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'>IF CreatorACL = NULL THEN<o:p></o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> // No ACL supplied
for the object<o:p></o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> IF (ComputeType =
DACL_COMPUTE) THEN<o:p></o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'>
Set ComputedACL to Token.DefaultDACL<o:p></o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> ELSE<o:p></o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'>
// No default for SACL; left as NULL<o:p></o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> ENDIF<o:p></o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'><o:p> </o:p></span></p>
<p class=code0 style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> ELSE<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-family:"Times New Roman","serif";
color:#1F497D'>Let me know if you require further assistance on this topic.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Best regards,<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-family:"Cambria","serif";
color:#1F497D'>Edgar</span><span style='color:#1F497D'><o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Nadezhda Ivanova
[mailto:nadezhda.ivanova@postpath.com] <br>
<b>Sent:</b> Thursday, August 06, 2009 10:38 AM<br>
<b>To:</b> Edgar Olougouna<br>
<b>Cc:</b> pfif@tridgell.net; cifs-protocol@samba.org<br>
<b>Subject:</b> RE: Information needed about security token default ACL<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Hi
Edgar,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>So,
if we must call ComputeInheritedACLFromParent with defaultSecurityDescriptor as
parent, does that mean that CreateSecurityDescriptor must have another argument
to allow passing of the defaultSecurityDescriptor? And I suppose the issue of
DEFAULT_DESCRIPTOR_FOR_OBJECT usage will be clarified in the updated MS-ADTS?
When can we expect this update to be available?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Also,
there is something I do not understand in your answer.
ComputeInheritedACLFromParent returns only the list of ACEs from the input ACL
that are inheritable, i.e have CI ot OI flag set – see the algorithm in
MS-DTYP, its pretty straightforward. IT only concatenates inheritable
ACE’s. So, if we pass defaultSecurityDescriptor to
ComputeInheritedACLFromParent, we will only get the inheritable ACE’s from
defaultSecurityDescriptor. That is not the case, however, as I have established
experimentally. <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>For
example, lets take the security descriptor of a domain-dns object in Win 2008.
It has no parent as it is an NC, its descriptor looks like this:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;S-1-5-21-3191434175-1265308384-3577286990-498)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;RP;;;WD)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;RPLCLORC;;;AU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;RPWPCRLCLOCCRCWDWOSW;;;DA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;CI;RPWPCRLCLOCCRCWDWOSDSW;;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;EA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;CI;LC;;;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;RP;c7407360-20bf-11d0-a768-00aa006e0529;;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RPLCLORC;;bf967a9c-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;RPRC;;;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RPLCLORC;;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;LCRPLORC;;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RPLCLORC;;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;AU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;DD)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;e2a36dc9-ae17-47c3-b58b-be34c55ba633;;S-1-5-32-557)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;280f369c-67c7-438e-ae98-1d46f3c6f541;;AU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501;;AU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;05c74c5e-4deb-43b4-bd9f-86664c2a7fd5;;AU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ae-9c07-11d1-f79f-00c04fc2dcd2;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ae-9c07-11d1-f79f-00c04fc2dcd2;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;CRRPWP;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;PS)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=FR style='font-size:10.0pt;font-family:"Arial","sans-serif"'>S:(AU;SA;WDWOWP;;;WD)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=FR style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(AU;SA;CR;;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=FR style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(AU;SA;CR;;;DU)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=FR style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OU;CISA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=FR style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OU;CISA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=FR style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>And
the defaultSecurityDescriptor of domain-DNS class is:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;S-1-5-21-3191434175-1265308384-3577286990-498)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;RP;;;WD)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ab-9c07-11d1-f79f-00c04fc2dcd2;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ac-9c07-11d1-f79f-00c04fc2dcd2;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;RPLCLORC;;;AU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;RPWPCRLCLOCCRCWDWOSW;;;DA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;CI;RPWPCRLCLOCCRCWDWOSDSW;;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;SY)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;CI;RPWPCRLCLOCCDCRCWDWOSDDTSW;;;EA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;CI;LC;;;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;RP;c7407360-20bf-11d0-a768-00aa006e0529;;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RPLCLORC;;bf967a9c-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;RPRC;;;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RPLCLORC;;bf967aba-0de6-11d0-a285-00aa003049e2;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(A;;LCRPLORC;;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RPLCLORC;;4828CC14-1437-45bc-9B07-AD6F015E5F28;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;RU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;RP;b8119fd0-04f6-4762-ab7a-4986c76b3f9a;;AU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;DD)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ad-9c07-11d1-f79f-00c04fc2dcd2;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;89e95b76-444d-4c62-991a-0facbeda640c;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;e2a36dc9-ae17-47c3-b58b-be34c55ba633;;S-1-5-32-557)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;280f369c-67c7-438e-ae98-1d46f3c6f541;;AU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501;;AU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;05c74c5e-4deb-43b4-bd9f-86664c2a7fd5;;AU)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ae-9c07-11d1-f79f-00c04fc2dcd2;;ED)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;;CR;1131f6ae-9c07-11d1-f79f-00c04fc2dcd2;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OA;CIIO;CRRPWP;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;PS)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=FR style='font-size:10.0pt;font-family:"Arial","sans-serif"'>S:(AU;SA;WDWOWP;;;WD)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=FR style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(AU;SA;CR;;;BA)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=FR style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(AU;SA;CR;;;DU)<o:p></o:p></span></p>
<p class=MsoNormal><span lang=FR style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OU;CISA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>(OU;CISA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>They
are absolutely identical, and both contain non-inheritable ace’s which would
not be in the domain object’s descriptor if the defaultSecurityDescriptor
was processed by ComputeInheritableFromParent, as you write. It could be that
the algorithm is not correct, I am still waiting for an update from Obaid on an
issue about that. I am sorry but it does not make sense to me….<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Regards,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Nadezhda
Ivanova</span><o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:12.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:navy'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div class=MsoNormal align=center style='text-align:center'><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'>
<hr size=2 width="100%" align=center>
</span></div>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Edgar Olougouna
[mailto:edgaro@microsoft.com] <br>
<b>Sent:</b> Thursday, August 06, 2009 5:47 PM<br>
<b>To:</b> Nadezhda Ivanova<br>
<b>Cc:</b> 'pfif@tridgell.net'; 'cifs-protocol@samba.org'<br>
<b>Subject:</b> RE: Information needed about security token default ACL</span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoPlainText>Hi Nadezhda,<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>We have completed investigation of your request. The
MS-ADTS document will be updated to address defaulting rules related to
defaultSecurityDescriptor when assigning security descriptors to AD objects.
Our revised response for your inquiry is as follows. <o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoNormal><b><span style='color:#1F497D'>Condition 1 : Parent contains
inheritable ACEs<o:p></o:p></span></b></p>
<p class=MsoListParagraph><span style='color:#1F497D'>Step 1. If the
control flags on the client allow inheritance then the inheritable ACEs from
the parent form the newly created object’s initial DACL and SACL <o:p></o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'>Step 2. If the
control flags on the client do not allow inheritance set initial DACL and
SACL to NULL<o:p></o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'>Step 3. If an
explicit security descriptor is provided by the client, that is merged with the
initial DACL and SACL.<o:p></o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'>Step 4. If an
explicit security descriptor is not provided by the client then the DACL and
SACL from the defaultSecurityDescriptor are merged with the initial DACL and
SACL. Method ComputeInheritedACLFromParent [MS-DTYP] section 2.5.2.6 should be
called passing DACL and SACL from the defaultSecurityDescriptor as the
parameters. <o:p></o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'>In ComputeACL method
[MS-DTYP] section 2.5.2.4 a call to ComputeInheritedACLFromParent should to be
made in the highlighted area :<o:p></o:p></span></p>
<p class=code><o:p> </o:p></p>
<p class=code>Set ComputedACL to NULL<o:p></o:p></p>
<p class=code>Set ComputedControl to NULL<o:p></o:p></p>
<p class=code><o:p> </o:p></p>
<p class=code>CALL ContainsInheritableACEs WITH ParentACL RETURNING result<o:p></o:p></p>
<p class=code><o:p> </o:p></p>
<p class=code>IF result = TRUE THEN<o:p></o:p></p>
<p class=code> // ParentACL contains inheritable ACEs<o:p></o:p></p>
<p class=code> <span style='color:windowtext'>IF(CreatorACL
is not present) OR<o:p></o:p></span></p>
<p class=code><span style='color:windowtext'>
((CreatorACL is present) AND<o:p></o:p></span></p>
<p class=code><span style='color:windowtext'>
(AutoInheritFlags contains DEFAULT_DESCRIPTOR))<o:p></o:p></span></p>
<p class=code><span style='color:windowtext'> THEN<o:p></o:p></span></p>
<p class=code><span style='color:windowtext'>
// Use only the inherited ACEs from the parent<o:p></o:p></span></p>
<p class=code><span style='color:windowtext'>
CALL ComputeInheritedACLFromParent WITH<o:p></o:p></span></p>
<p class=code><span style='color:windowtext'>
ParentACL, IsContainerObject, ObjectTypes<o:p></o:p></span></p>
<p class=code><span style='color:windowtext'>
RETURNING NextACL<o:p></o:p></span></p>
<p class=code><span style='color:windowtext'>
CALL PostProcessACL WITH<o:p></o:p></span></p>
<p class=code><span style='color:windowtext'>
NextACL, Owner, Group, GenericMapping<o:p></o:p></span></p>
<p class=code><span style='color:windowtext'>
RETURNING FinalACL<o:p></o:p></span></p>
<p class=code><span style='font-size:12.0pt;font-family:"Calibri","sans-serif";
color:windowtext'> <span
style='background:yellow'>Here ComputeInheritedACLFromParent should be called
passing defaultSecurityDescriptor. The ACLs obtained via this call should be
merged with the FinalACL above. That will be the new resultant FinalACL</span><o:p></o:p></span></p>
<p class=code><span style='color:windowtext'> Set
ComputedACL to FinalACL</span><span style='font-size:8.0pt;color:windowtext'><o:p></o:p></span></p>
<p class=code><span style='color:windowtext'> ENDIF<o:p></o:p></span></p>
<p class=code><o:p> </o:p></p>
<p class=code> IF ((CreatorACL is present) AND<o:p></o:p></p>
<p class=code> (AutoInheritFlags does not contain
DEFAULT_DESCRIPTOR))<o:p></o:p></p>
<p class=code> THEN<o:p></o:p></p>
<p class=code> CALL
PreProcessACLFromCreator WITH CreatorACL<o:p></o:p></p>
<p class=code> RETURNING PreACL<o:p></o:p></p>
<p class=code><o:p> </o:p></p>
<p class=code> CALL
ComputeInheritedACLFromCreator WITH<o:p></o:p></p>
<p class=code> PreACL,
IsContainerObject, ObjectTypes<o:p></o:p></p>
<p class=code> RETURNING TmpACL<o:p></o:p></p>
<p class=code><o:p> </o:p></p>
<p class=code> IF((ComputeType =
DACL_COMPUTE) AND<o:p></o:p></p>
<p class=code>
(CreatorControl does not contain DACL_PROTECTED) AND<o:p></o:p></p>
<p class=code>
(AutoInheritFlags contains DACL_AUTO_INHERIT flag))<o:p></o:p></p>
<p class=code> THEN<o:p></o:p></p>
<p class=code>
// Compute the inherited ACEs from the parent<o:p></o:p></p>
<p class=code>
CALL ComputeInheritedACLFromParent WITH<o:p></o:p></p>
<p class=code>
ParentACL, IsContainerObject, ObjectTypes<o:p></o:p></p>
<p class=code>
RETURNING ParentACL<o:p></o:p></p>
<p class=code>
Append ParentACL.ACEs to TmpACL.ACEs<o:p></o:p></p>
<p class=code>
Add DACL_AUTO_INHERITED to ComputedControl<o:p></o:p></p>
<p class=code> ELSE <o:p></o:p></p>
<p class=code>
IF ((ComputeType = SACL_COMPUTE) AND<o:p></o:p></p>
<p class=code>
(CreatorControl does not contain SACL_PROTECTED) AND<o:p></o:p></p>
<p class=code>
(AutoInheritFlags contains SACL_AUTO_INHERIT flag))<o:p></o:p></p>
<p class=code>
THEN<o:p></o:p></p>
<p class=code>
// Compute the inherited ACEs from the parent<o:p></o:p></p>
<p class=code>
CALL ComputeInheritedACLFromParent WITH<o:p></o:p></p>
<p class=code>
ParentACL,
IsContainerObject, ObjectTypes<o:p></o:p></p>
<p class=code>
RETURNING ParentACL<o:p></o:p></p>
<p class=code>
Append ParentACL.ACEs to TmpACL.ACEs<o:p></o:p></p>
<p class=code>
Add SACL_AUTO_INHERITED to ComputedControl<o:p></o:p></p>
<p class=code>
ENDIF<o:p></o:p></p>
<p class=code> ENDIF<o:p></o:p></p>
<p class=code> ENDIF<o:p></o:p></p>
<p class=code><o:p> </o:p></p>
<p class=code><span style='font-size:12.0pt;font-family:"Calibri","sans-serif"'>
<span style='background:yellow'>If (CREATORACL is absent)<o:p></o:p></span></span></p>
<p class=code><span style='font-size:12.0pt;font-family:"Calibri","sans-serif";
background:yellow'> Here ACLs should
be obtained from the parent and be merged with those from the
defaultSecurityDescriptor. Both via calls to
ComputeInheritedACLFromParent. <o:p></o:p></span></p>
<p class=code><span style='font-size:12.0pt;font-family:"Calibri","sans-serif";
background:yellow'> ENDIF</span><span style='font-size:12.0pt;
font-family:"Calibri","sans-serif"'><o:p></o:p></span></p>
<p class=code><span style='font-size:8.0pt'><o:p> </o:p></span></p>
<p class=code> CALL PostProcessACL WITH<o:p></o:p></p>
<p class=code> TmpACL, Owner, Group,
GenericMapping<o:p></o:p></p>
<p class=code> RETURNING ProcessedACL<o:p></o:p></p>
<p class=code><o:p> </o:p></p>
<p class=code> Set ComputedACL to ProcessedACL<o:p></o:p></p>
<p class=code><o:p> </o:p></p>
<p class=code>ELSE // ParentACL does not contain inheritable ACEs<o:p></o:p></p>
<p class=MsoListParagraph><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoListParagraph><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><b><span style='color:#1F497D'>Condition 2 : Parent does not
contain inheritable ACEs<o:p></o:p></span></b></p>
<p class=MsoNormal><span style='color:#1F497D'>
If the parentACL does not contain inheritable ACEs then check to see if a
defaultSecurityDescriptor for the objectClass under consideration is present. <o:p></o:p></span></p>
<p class=MsoNormal style='text-indent:.5in'><span style='color:#1F497D'>If
defaultSecurityDescriptor is <b>present</b> then call
ComputeInheritedACLFromParent by passing (<b>ACL from defaultSecurityDescriptor</b>)
in place of <b>ParentACL</b>. That is the following part in the ComputeACL
method [MS-DTYP] section 2.5.2.4.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=code style='margin-left:.5in'><span style='color:#548DD4'> </span><span
style='font-family:"Calibri","sans-serif";color:#548DD4'>CALL
ComputeInheritedACLFromParent WITH<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> <b>ParentACL</b>,
IsContainerObject, ObjectTypes<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> RETURNING NextACL<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> CALL PostProcessACL WITH<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> NextACL,
Owner, Group, GenericMapping<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> RETURNING FinalACL<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> Set ComputedACL to FinalACL<o:p></o:p></span></p>
<p class=code><span style='font-family:"Calibri","sans-serif";color:#548DD4'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>In this case the security
information in the token need not be used. <o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><b><span style='color:#1F497D'>Condition 3 : Parent does not
contain inheritable ACEs AND defaultSecurityDescriptor for the particular
object is absent<o:p></o:p></span></b></p>
<p class=MsoNormal><span style='color:#1F497D'>If the defaultSecurityDescriptor
of the particular objectClass under consideration is <b>absent</b> then make
use of Token as described in the ComputeACL method.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'>ELSE // ParentACL does not contain inheritable ACEs<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'>IF CreatorACL = NULL THEN<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> // No ACL supplied
for the object<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> IF (ComputeType =
DACL_COMPUTE) THEN<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'>
Set ComputedACL to Token.DefaultDACL<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> ELSE<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'>
// No default for SACL; left as NULL<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> ENDIF<o:p></o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'><o:p> </o:p></span></p>
<p class=code style='margin-left:.5in'><span style='font-family:"Calibri","sans-serif";
color:#548DD4'> ELSE<o:p></o:p></span></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Let us know if you need further assistance on this topic.
<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Best regards,<o:p></o:p></p>
<p class=MsoPlainText>Edgar<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>-----Original Message-----<br>
From: Nadezhda Ivanova [mailto:nadezhda.ivanova@postpath.com] <br>
Sent: Friday, July 31, 2009 6:53 AM<br>
To: Edgar Olougouna<br>
Cc: pfif@tridgell.net; cifs-protocol@samba.org<br>
Subject: RE: Information needed about security token default ACL<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Hi Edgar,<o:p></o:p></p>
<p class=MsoPlainText>Thank you for your explanation. It answered a lot of
questions, but also raised some more, see below:<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>> -----Original Message-----<o:p></o:p></p>
<p class=MsoPlainText>> From: Edgar Olougouna [mailto:edgaro@microsoft.com]<o:p></o:p></p>
<p class=MsoPlainText>> Sent: Thursday, July 30, 2009 5:37 PM<o:p></o:p></p>
<p class=MsoPlainText>> To: Nadezhda Ivanova<o:p></o:p></p>
<p class=MsoPlainText>> Cc: 'pfif@tridgell.net'; 'cifs-protocol@samba.org'<o:p></o:p></p>
<p class=MsoPlainText>> Subject: RE: Information needed about security token
default ACL<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> Hi Nadezhda,<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> This response relates to the portion of your inquiry
regarding the<o:p></o:p></p>
<p class=MsoPlainText>> CreateSecurityDescriptor algorithm. I hope the
following information will<o:p></o:p></p>
<p class=MsoPlainText>> clarify how CreatorDescriptor and
defaultSecuritiDescriptor relate to the<o:p></o:p></p>
<p class=MsoPlainText>> CreateSecurityDescriptor procedure.<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> The CreatorDescriptor (optional) is a security
descriptor explicitly<o:p></o:p></p>
<p class=MsoPlainText>> provided by the creator of the object. The creator
of the object is the<o:p></o:p></p>
<p class=MsoPlainText>> subject that is creating the object. A subject is a
thread executing in<o:p></o:p></p>
<p class=MsoPlainText>> the security context provided by an access token.<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> [MS-ADTS] Section 7 provides additional information
that may help on your<o:p></o:p></p>
<p class=MsoPlainText>> topic. Section "7.1.3 Security Descriptor
Requirements" details the<o:p></o:p></p>
<p class=MsoPlainText>> parameters used by the CreateSecurityDescriptor
algorithm to compute the<o:p></o:p></p>
<p class=MsoPlainText>> resultant security descriptor value of an AD object,
for instance<o:p></o:p></p>
<p class=MsoPlainText>> AutoInheritFlags: DACL_AUTO_INHERIT |
SACL_AUTO_INHERIT.<o:p></o:p></p>
<p class=MsoPlainText>> Note these key points when an ACL is built for an AD
object compared to<o:p></o:p></p>
<p class=MsoPlainText>> other types of objects:<o:p></o:p></p>
<p class=MsoPlainText>> * Generic
inheritable ACEs apply to all types of child objects.<o:p></o:p></p>
<p class=MsoPlainText>> Object-specific inheritable ACEs apply only to a
specific type of child<o:p></o:p></p>
<p class=MsoPlainText>> object.<o:p></o:p></p>
<p class=MsoPlainText>> * If there is no
supplied security descriptor, no parent-inheritable<o:p></o:p></p>
<p class=MsoPlainText>> ACEs, the operating system uses the ACL from the defaultSecurityDescriptor<o:p></o:p></p>
<p class=MsoPlainText>> in the classSchema object.<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> Based on the CreateSecurityDescriptor procedure from
[MS-DTYP] 2.5.2.3,<o:p></o:p></p>
<p class=MsoPlainText>> you can apply the following rules to ACL assignment
for a new AD object:<o:p></o:p></p>
<p class=MsoPlainText>> If an explicit security descriptor (CreatorDescriptor)
is provided by the<o:p></o:p></p>
<p class=MsoPlainText>> client, then that forms the object's initial DACL
and SACL. If the<o:p></o:p></p>
<p class=MsoPlainText>> client's controls allow inheritance then the
inheritable ACEs from the<o:p></o:p></p>
<p class=MsoPlainText>> parent are merged into the object's initial DACL and
SACL.<o:p></o:p></p>
<p class=MsoPlainText>> If the client does not provide an explicit security
descriptor then the<o:p></o:p></p>
<p class=MsoPlainText>> inheritable ACEs from the parent are merged into the
new object's DACL and<o:p></o:p></p>
<p class=MsoPlainText>> SACL. For details please refer to [MS-DTYP] section
2.5.2.4 ComputeACL<o:p></o:p></p>
<p class=MsoPlainText>> method. If the parent contains object-specific
inheritable ACEs then the<o:p></o:p></p>
<p class=MsoPlainText>> defaultSecurityDescriptor is not used during the
security descriptor<o:p></o:p></p>
<p class=MsoPlainText>> creation process for the newly added object.<o:p></o:p></p>
<p class=MsoPlainText>[Nadezhda Ivanova]<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Above you state that defaultSecurityDescriptor is used if
there are NO inheritable ACE's, here you say it's used if there are no
Object-Specific Inheritable ACE's... If there are non-object specific
inheritable ACE's , do we merge them in with the ace's from the
defaultSecurityDescriptor?<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>> If the parent does not contain object-specific
inheritable ACEs then the<o:p></o:p></p>
<p class=MsoPlainText>> defaultSecurityDescriptor from the Active Directory
schema for the object<o:p></o:p></p>
<p class=MsoPlainText>> type is used. Following the definition of method
ComputeACL in [MS-DTYP]<o:p></o:p></p>
<p class=MsoPlainText>> 2.5.2.4, method ComputeInheritedACLFromParent
[MS-DTYP] section 2.5.2.6<o:p></o:p></p>
<p class=MsoPlainText>> can be called by passing ACLs from the
defaultSecurityDescriptor as the<o:p></o:p></p>
<p class=MsoPlainText>> parameters.<o:p></o:p></p>
<p class=MsoPlainText>[Nadezhda Ivanova]<o:p></o:p></p>
<p class=MsoPlainText>I need clarification here. By definition
ComputeInheritedACLFromParent accepts the Parent's descriptor and returns the
set of ACE's to be inherited by the new object. How exactly do you use it with
defaultSecurityDescriptor's ACE?<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>I assume you mean the following part of computeACL:<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>IF result = TRUE<o:p></o:p></p>
<p class=MsoPlainText> THEN //
ParentACL contains inheritable ACEs<o:p></o:p></p>
<p class=MsoPlainText> IF(CreatorACL
is not present) OR ((CreatorACL is
present)
AND(AutoInheritFlags contains DEFAULT_DESCRIPTOR))<o:p></o:p></p>
<p class=MsoPlainText> THEN // Use
only the inherited ACEs from the parent<o:p></o:p></p>
<p class=MsoPlainText>
CALL ComputeInheritedACLFromParent WITH
ParentACL,
IsContainerObject, ObjectTypes<o:p></o:p></p>
<p class=MsoPlainText>
RETURNING NextACL<o:p></o:p></p>
<p class=MsoPlainText> CALL
PostProcessACL WITH NextACL, Owner, Group, GenericMapping RETURNING
FinalACL<o:p></o:p></p>
<p class=MsoPlainText> Set
ComputedACL to FinalACL<o:p></o:p></p>
<p class=MsoPlainText> ENDIF<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Here is the description of DEFAULT_DESCRIPTOR:<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>DEFAULT_DESCRIPTOR_FOR_OBJECT: Selects the
CreatorDescriptor as the default security descriptor provided that no object
type specific ACEs are inherited from the parent. If such ACEs do get
inherited, CreatorDescriptor is ignored.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>So, it appears that the defaultSecurityDescriptor is
passed on as CreatorDescriptor, and the DEFAULT_DESCRIPTOR_FOR_OBJECT flag is
raised in this case. How does that connect with calling
ComputeInheritedACLFromParent with defaultSecurityDescriptors ACE's.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Also, the above portion of the algorithm appears to
always disregard CreatorACL if the flag is raised, and not if the flag is
raised AND the parent contains Object-Specific inheritable ACES, as the flag's
description and your answer state. So, what am I missing here?<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>> If the Active Directory schema does not specify a<o:p></o:p></p>
<p class=MsoPlainText>> defaultSecurityDescriptor for the object type then
the security<o:p></o:p></p>
<p class=MsoPlainText>> information in the requestor's token is used. For
details about the usage<o:p></o:p></p>
<p class=MsoPlainText>> of the requestor's token please refer [MS-DTYP]
Section 2.5.2.4<o:p></o:p></p>
<p class=MsoPlainText>> ComputeACL.<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> Please let me know if you need further assistance on
this topic.<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> Best regards,<o:p></o:p></p>
<p class=MsoPlainText>> Edgar<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> -----Original Message-----<o:p></o:p></p>
<p class=MsoPlainText>> From: Nadezhda Ivanova [mailto:nadezhda.ivanova@postpath.com]<o:p></o:p></p>
<p class=MsoPlainText>> Sent: Friday, July 17, 2009 7:46 AM<o:p></o:p></p>
<p class=MsoPlainText>> To: Interoperability Documentation Help<o:p></o:p></p>
<p class=MsoPlainText>> Cc: pfif@tridgell.net; cifs-protocol@samba.org<o:p></o:p></p>
<p class=MsoPlainText>> Subject: Information needed about security token
default ACL<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> Hi,<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> In the course of my work in implementing security
descriptor inheritance<o:p></o:p></p>
<p class=MsoPlainText>> in Directory service of Samba 4, I came across the
following statement in<o:p></o:p></p>
<p class=MsoPlainText>> MS-DTYP, 2.5.2<o:p></o:p></p>
<p class=MsoPlainText>> "The token also contains an ACL,
Token.DefaultDACL, that serves as the<o:p></o:p></p>
<p class=MsoPlainText>> DACL assigned by default to any objects created by
the user. "<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> So, am I right to understand that this DACL is used
when no<o:p></o:p></p>
<p class=MsoPlainText>> nTSecurityDescriptor is provided by the incoming
LDAP add request, and<o:p></o:p></p>
<p class=MsoPlainText>> there is no defaultSecurityDescriptor for the
objectClass.<o:p></o:p></p>
<p class=MsoPlainText>> If so, how is the Token.DefaultDACL constructed and
when? Is this based on<o:p></o:p></p>
<p class=MsoPlainText>> the user's credentials and how?<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> In addition, I have a question about the security
descriptor creation<o:p></o:p></p>
<p class=MsoPlainText>> algorithm described in MS-DTYP 2.5.2.3<o:p></o:p></p>
<p class=MsoPlainText>> One of the arguments of CreateSecurityDescriptor is:<o:p></o:p></p>
<p class=MsoPlainText>> CreatorDescriptor: Security descriptor for the new
object provided by the<o:p></o:p></p>
<p class=MsoPlainText>> creator of the object. Caller can pass NULL.<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> Am I right in understanding that this is either the
nTSecurityDescriptor<o:p></o:p></p>
<p class=MsoPlainText>> attribute provided by the user, or, in the lack
thereof, the<o:p></o:p></p>
<p class=MsoPlainText>> defaultSecurityDescriptor of the object class?<o:p></o:p></p>
<p class=MsoPlainText>><o:p> </o:p></p>
<p class=MsoPlainText>> Best Regards,<o:p></o:p></p>
<p class=MsoPlainText>> Nadezhda Ivanova<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>