<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
p.normal-list, li.normal-list, div.normal-list
{mso-style-name:normal-list;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.DSTOC1-4, li.DSTOC1-4, div.DSTOC1-4
{mso-style-name:DSTOC1-4;
margin-top:12.0pt;
margin-right:0in;
margin-bottom:6.0pt;
margin-left:-1.45pt;
text-indent:-9.35pt;
page-break-after:avoid;
font-size:10.0pt;
font-family:"Verdana","sans-serif";
font-weight:bold;}
span.Bold
{mso-style-name:"Bold\,b";
font-weight:bold;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:155729395;
mso-list-template-ids:-113731400;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-start-at:5;
mso-level-legal-format:yes;
mso-level-text:"%1\.%2";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:55.2pt;
text-indent:-37.2pt;}
@list l0:level3
{mso-level-start-at:3;
mso-level-legal-format:yes;
mso-level-text:"%1\.%2\.%3";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:55.2pt;
text-indent:-37.2pt;}
@list l0:level4
{mso-level-start-at:4;
mso-level-legal-format:yes;
mso-level-text:"%1\.%2\.%3\.%4";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:55.2pt;
text-indent:-37.2pt;}
@list l0:level5
{mso-level-legal-format:yes;
mso-level-text:"%1\.%2\.%3\.%4\.%5";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.0in;
text-indent:-.75in;}
@list l0:level6
{mso-level-legal-format:yes;
mso-level-text:"%1\.%2\.%3\.%4\.%5\.%6";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.0in;
text-indent:-.75in;}
@list l0:level7
{mso-level-legal-format:yes;
mso-level-text:"%1\.%2\.%3\.%4\.%5\.%6\.%7";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.0in;
text-indent:-.75in;}
@list l0:level8
{mso-level-legal-format:yes;
mso-level-text:"%1\.%2\.%3\.%4\.%5\.%6\.%7\.%8";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-1.0in;}
@list l0:level9
{mso-level-legal-format:yes;
mso-level-text:"%1\.%2\.%3\.%4\.%5\.%6\.%7\.%8\.%9";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-1.0in;}
@list l1
{mso-list-id:723529649;
mso-list-template-ids:-722669068;}
@list l1:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ascii-font-family:"Segoe UI";
mso-fareast-font-family:"Times New Roman";
mso-hansi-font-family:"Segoe UI";
mso-bidi-font-family:"Segoe UI";}
@list l1:level2
{mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Nadya,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As a result of this investigation, a new note will be added in MS-DTYP Section 2.5.3.4 to explain how inheritance logic is impacted by protected ACLs. Please find below the provisional change that will appear in a future release of the
document.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Current MS-DTYP:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="DSTOC1-4" style="margin:0in;margin-bottom:.0001pt;text-indent:0in"><a name="_Toc288438366"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";font-weight:normal"> 2.5.3.4 Algorithm for Creating a Security Descriptor</span></a><a name="z0f0c6ffcf57d47f8a6c863889e874e24"></a><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";font-weight:normal"><o:p></o:p></span></p>
<p class="MsoNormal"> <a href="http://msdn.microsoft.com/en-us/library/cc230299(v=PROT.10).aspx">
http://msdn.microsoft.com/en-us/library/cc230299(v=PROT.10).aspx</a><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="normal-list" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;text-indent:-.25in;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Any ACEs with the INHERITED_ACE bit set are NOT copied to the assigned security descriptor.<o:p></o:p></span></p>
<p class="normal-list" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;text-indent:-.25in;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black"><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">If
</span><em><span style="color:black">AutoInheritFlags</span></em><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">, as specified in section
<a href="http://msdn.microsoft.com/en-us/library/cc230315(v=PROT.10)">2.5.3.4.1</a>, is set to automatically inherit ACEs from the parent (DACL_AUTO_INHERIT or SACL_AUTO_INHERIT), inherited ACEs from the parent are appended after explicit ACEs from the
</span><em><span style="color:black">CreatorDescriptor</span></em><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">. For further details, see the parameter list for CreateSecurityDescriptor (section 2.5.3.4.1).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal">MS-DTYP update similar to the following:<o:p></o:p></p>
<p class="DSTOC1-4" style="margin:0in;margin-bottom:.0001pt;text-indent:0in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";font-weight:normal"><o:p> </o:p></span></p>
<p class="DSTOC1-4" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:55.2pt;margin-bottom:.0001pt;text-indent:-37.2pt;mso-list:l0 level4 lfo1">
<![if !supportLists]><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";font-weight:normal"><span style="mso-list:Ignore">2.5.3.4<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";font-weight:normal"> Algorithm for Creating a Security Descriptor<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="normal-list" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;text-indent:-.25in;mso-list:l1 level1 lfo2">
<![if !supportLists]><span style="font-size:11.0pt;font-family:"Segoe UI","sans-serif";color:black"><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">Any ACEs with the INHERITED_ACE bit set are NOT copied to the assigned security descriptor.<o:p></o:p></span></p>
<p class="normal-list" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;text-indent:-.25in;mso-list:l1 level1 lfo2">
<![if !supportLists]><span style="font-size:11.0pt;font-family:"Segoe UI","sans-serif";color:black"><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">If
</span><em><span style="color:black">AutoInheritFlags</span></em><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">, as specified in section
<a href="http://msdn.microsoft.com/en-us/library/cc230315(v=PROT.10)">2.5.3.4.1</a>, is set to automatically inherit ACEs from the parent (DACL_AUTO_INHERIT or SACL_AUTO_INHERIT), inherited ACEs from the parent are appended after explicit ACEs from the
</span><em><span style="color:black">CreatorDescriptor</span></em><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">. For further details, see the parameter list for CreateSecurityDescriptor (section 2.5.3.4.1).<o:p></o:p></span></p>
<p class="normal-list" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;text-indent:-.25in;mso-list:l1 level1 lfo2">
<![if !supportLists]><span style="font-size:11.0pt;font-family:"Segoe UI","sans-serif";color:black;background:yellow;mso-highlight:yellow"><span style="mso-list:Ignore">3.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";background:yellow;mso-highlight:yellow">The preceding table describing
<span class="Bold">ACL</span> inheritance logic holds true if the <span class="Bold">
ACL</span> is not protected. If the <span class="Bold">ACL</span> is protected, all the ACEs from the Explicit
<span class="Bold">ACL</span> are copied into the assigned security descriptor, resetting any ACEs with the INHERITED_ACE bit set as well. The Inheritable
<span class="Bold">ACL</span> is not considered.<span style="color:black"><o:p></o:p></span></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal">Thanks again for helping us improve the MS-DTYP document.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best regards,<o:p></o:p></p>
<p class="MsoNormal">Edgar<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Edgar Olougouna
<br>
<b>Sent:</b> Tuesday, March 08, 2011 4:16 PM<br>
<b>To:</b> 'nivanova@samba.org'; 'cifs-protocol@samba.org'<br>
<b>Subject:</b> RE: Question about MS-DTYP 2.5.3.4 Algorithm for Creating a Security Descriptor<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Nadya,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks for reporting this issue to Microsoft. We confirmed that the behavior you observed is expected. A technical document issue was filed to clarify the algorithm for creating a security descriptor when the creator security descriptor
supplies a protected DACL and ACEs with INHERITED_ACE.<o:p></o:p></p>
<p class="MsoNormal">The product team is working on the details of updating the relevant algorithm either in MS-DTYP or MS-ADTS, whichever is appropriate.
<o:p></o:p></p>
<p class="MsoNormal">As an informative reference, Chapter 8 of Windows Internals (4<sup>th</sup> edition, 2004), which provides an overview of the rules for creating security descriptors, can be consulted on this behavior.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best regards,<o:p></o:p></p>
<p class="MsoNormal">Edgar<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Edgar Olougouna
<br>
<b>Sent:</b> Thursday, February 10, 2011 4:25 PM<br>
<b>To:</b> 'nivanova@samba.org'; cifs-protocol@samba.org<br>
<b>Subject:</b> RE: Question about MS-DTYP 2.5.3.4 Algorithm for Creating a Security Descriptor<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Nadya,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I am researching this and will update you as soon as I have news.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Edgar<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> didrash@gmail.com [mailto:didrash@gmail.com]
<b>On Behalf Of </b>Nadezhda Ivanova<br>
<b>Sent:</b> Wednesday, February 09, 2011 8:04 AM<br>
<b>To:</b> Interoperability Documentation Help; cifs-protocol@samba.org<br>
<b>Subject:</b> Question about MS-DTYP 2.5.3.4 Algorithm for Creating a Security Descriptor<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi,<br>
I have a question regarding 2.5.3.4 Algorithm for Creating a Security Descriptor.<br>
<br>
It is said there that any ACEs provided by the user that contain the INHERITED_ACE flag are not included in the final SD assigned to the object, and in the algorithm they are also disregarded. This is indeed the behavior I observed.<br>
I created a group, providing this security descriptor during creation: <br>
"D:(A;ID;WP;;;AU)"<br>
When I read the SD of the object back, it read O:DAG:DUD:AIS:AI(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)<br>
It had no DACL, as expected.<br>
<br>
However, when I performed the same test with a very small change, creating the object with this SD - "D:P(A;ID;WP;;;AU)"<br>
The resulted SD is: O:DAG:DUD:PAI(A;;WP;;;AU)S:AI(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)<br>
<br>
So, it turns out that ACEs with INHERITED_ACE flag provided by the user are not ignored if we break the inheritance at that object. I haven't found in the docs where this is specified, however. Is this a desired behavior?<br>
<br>
I am testing against win2003R2<br>
<br>
Regards,<br>
Nadya<o:p></o:p></p>
</div>
</body>
</html>