<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Douglas,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I will research your question and let you know what I find. </div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Arial, sans-serif; font-size: 10pt; color: blue;">Best regards,</span><span style="font-family: Arial, sans-serif; font-size: 10pt; color: navy;"><b><br>
<i>Jeff M</i></b></span><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 32, 96);"><b><i><sup>c</sup></i></b></span><span style="font-family: Arial, sans-serif; font-size: 10pt; color: navy;"><b><i>Cashland (He/him)
</i>| Senior Escalation Engineer | Microsoft Corporation</b></span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Arial, sans-serif; font-size: 9pt; color: blue;">Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada)</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Arial, sans-serif; font-size: 8pt; color: blue;">Local country phone number found here:
<u><a href="http://support.microsoft.com/globalenglish" style="color: blue; margin-top: 0px; margin-bottom: 0px;">http://support.microsoft.com/globalenglish</a></u> | Extension 1138300</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"> </p>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Sreekanth Nadendla <srenaden@microsoft.com><br>
<b>Sent:</b> Wednesday, May 8, 2024 8:54 AM<br>
<b>To:</b> Douglas Bagnall <douglas.bagnall@catalyst.net.nz><br>
<b>Cc:</b> cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
<b>Subject:</b> [MS-DTYP] canonical ACL sort order Q4 - TrackingID#2405080040008294</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div class="x_elementToProof" style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
</div>
<div id="x_x_x_divRplyFwdMsg" dir="ltr"></div>
<div style="direction:ltr; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Dochelp in Bcc</div>
<div style="direction:ltr; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hello Douglas, this e-mail thread will be used to track the investigation for the following issue</div>
<div style="direction:ltr; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<b>ISSUE:</b></div>
<div style="direction:ltr; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div class="x_elementToProof" style="direction:ltr; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
There are a wide range of formulations of canonicity, from</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Microsoft and elsewhere, not all of which can be compatible. For</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
example,</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fdotnet%2Fapi%2Fsystem.security.accesscontrol.commonacl%3Fview%3Dnet-8.0&data=05%7C02%7Csrenaden%40microsoft.com%7Cfe0af73840584248d61808dc6ef382d9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638507239378701549%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=pfebzEmURR5OTZQD%2B1JkZVW1KzYXj%2BmJO%2BVe%2Fvt3Rzc%3D&reserved=0</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
would not sort the ACEs lexicographically, but by SID.</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div class="x_elementToProof" style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<b>Do SACLs have a canonical ordering, beyond having explicit ACEs first?</b></div>
<div style="direction:ltr; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_x_x_x_Signature">
<p style="margin-top:0px; margin-bottom:0px"><span style="font-family:"Segoe UI","Segoe UI Web (West European)","Segoe UI",-apple-system,BlinkMacSystemFont,Roboto,"Helvetica Neue",sans-serif; font-size:15px; color:black">Regards,</span></p>
<p style="margin-top:0px; margin-bottom:0px"><span style="font-family:"Segoe UI","Segoe UI Web (West European)","Segoe UI",-apple-system,BlinkMacSystemFont,Roboto,"Helvetica Neue",sans-serif; font-size:15px; color:black">Sreekanth Nadendla</span></p>
<p style="margin-top:0px; margin-bottom:0px"><span style="font-family:"Segoe UI","Segoe UI Web (West European)","Segoe UI",-apple-system,BlinkMacSystemFont,Roboto,"Helvetica Neue",sans-serif; font-size:15px; color:black">Microsoft Windows Open Specifications</span></p>
</div>
<div id="x_x_x_x_appendonsend"></div>
<div style="direction:ltr; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr style="direction:ltr; display:inline-block; width:98%">
<div id="x_x_x_x_divRplyFwdMsg" dir="ltr" class="x_x_x_x_elementToProof x_x_x_elementToProof x_x_elementToProof x_elementToProof">
<span style="font-family:Calibri,sans-serif; font-size:11pt; color:rgb(0,0,0)"><b>From:</b> Douglas Bagnall <douglas.bagnall@catalyst.net.nz><br>
</span></div>
<div style="direction:ltr; font-family:Calibri,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<b>Sent:</b> Tuesday, May 7, 2024 8:11 PM<br>
<b>To:</b> Interoperability Documentation Help <dochelp@microsoft.com>; cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
<b>Subject:</b> [EXTERNAL] [MS-DTYP] canonical ACL sort order</div>
<div style="direction:ltr"> </div>
<div class="x_elementToProof" style="direction:ltr; font-size:11pt">hi Dochelp.<br>
<br>
I have questions about the definition of the canonical ACL form, to do<br>
with the status of callback ACEs and the ordering of inherited ACEs.<br>
<br>
MS-DTYP 2.4.5 says:<br>
<br>
> An ACL is said to be in canonical form if:<br>
><br>
> * All explicit ACEs are placed before inherited ACEs.<br>
><br>
> * Within the explicit ACEs, deny ACEs come before grant ACEs.<br>
><br>
> * Deny ACEs on the object come before deny ACEs on a child or property.<br>
><br>
> * Grant ACEs on the object come before grant ACEs on a child or property.<br>
><br>
> * Inherited ACEs are placed in the order in which they were inherited.<br>
<br>
I think the third and fourth clauses are talking about the OBJECT ACE<br>
types, saying that e.g. ACCESS_ALLOWED_OBJECT_ACE_TYPE comes after<br>
ACCESS_ALLOWED_ACE_TYPE. But is it also talking about ACEs with the<br>
INHERIT_ONLY_ACE flag? Or some other mechanism?<br>
<br>
Logically it would seem that callback ACEs should be placed is a similar<br>
position to the OBJECT ones.<br>
<br>
Relevantly, MS-ADTS 6.1.3.1 says:<br>
<br>
> ACE ordering rules apply only to ACLs in canonical form (see [MS-DTYP]<br>
> section 2.4.5), and only when the forest functional level is<br>
> DS_BEHAVIOR_WIN2003 or above. The following rules are applied, in the<br>
> following order:<br>
><br>
> 1. Explicit ACEs come before inherited ACEs.<br>
><br>
> 2. Deny ACEs come before Allow ACEs.<br>
><br>
> 3. Regular ACEs come before object ACEs.<br>
><br>
> 4. Within each group, the ACEs are ordered lexicographically (that is, based on<br>
> octet string comparison rules).<br>
><br>
> Rules 3 and 4 above are enforced only when the forest functional level is<br>
> DS_BEHAVIOR_WIN2003 or above. Otherwise, the order of ACEs within each group<br>
> defined by rules 1 and 2 is retained as supplied by the user or replication<br>
> partner.<br>
<br>
Point 4 (sorting "lexicographically" via binary comparison), would sort<br>
the ACE structures primarily by ACE type, followed by flags, followed by<br>
the type specific members (often the SID is next).<br>
<br>
That would put the DENY ACEs in this order:<br>
<br>
ACCESS_DENIED_ACE_TYPE (1)<br>
ACCESS_DENIED_OBJECT_ACE_TYPE (6)<br>
ACCESS_DENIED_CALLBACK_ACE_TYPE (10)<br>
ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE (12)<br>
<br>
and similarly for the ALLOW ACEs. But by rule 3, we already have put<br>
"regular" ACEs before object ACEs, so if callback ACEs count as regular,<br>
we'd end up with<br>
<br>
ACCESS_DENIED_ACE_TYPE (1)<br>
ACCESS_DENIED_CALLBACK_ACE_TYPE (10)<br>
ACCESS_DENIED_OBJECT_ACE_TYPE (6)<br>
ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE (12)<br>
<br>
Are one of these orderings considered to be part of the canonical form?<br>
<br>
Either would be consistent with my understanding of MS-DTYP 2.4.5 with<br>
respect to plain and object ACEs.<br>
<br>
(As far as I can tell, the ordering within a block of DENY or ALLOW ACEs<br>
doesn't matter with respect to the eventual outcome, but putting the<br>
fancy kinds at the back is likely to be more efficient as it might avoid<br>
the extra work they entail).<br>
<br>
Also I note the MS-DTYP definition says little about the ordering of<br>
DENY and ALLOW ACEs in the inherited sections. In places where canonical<br>
ACLs are constructed, such as<br>
<br>
<a href="https://learn.microsoft.com/en-us/windows/win32/SecAuthZ/order-of-aces-in-a-dacl" originalsrc="https://learn.microsoft.com/en-us/windows/win32/SecAuthZ/order-of-aces-in-a-dacl" shash="q6XqcGQUSJw0RreF9xRipY3o/lmkpAtga1M9cSOBpgagwyidk6kFgsC0Qt6Zoi/dLhSDi2gpL1dfVLuW5D/QfrLxOZhN2QCqvnFYHj0nLDQ7DldiBHDcEnWF2/alnqCOAuphzA8/u9VTv7vbRmDseK7duls8qTMHhXGCxvdDet8=" originalsrc="https://learn.microsoft.com/en-us/windows/win32/SecAuthZ/order-of-aces-in-a-dacl" shash="be+lzn8zYgpCeQmL2ksps/+ObnrTeofuU3ZBaoIQmq1uoPocGKQ5WreUXVnCjGbW2znSJImoFzN7L9cQgr/4sL9UpoaDCI9r1dBSd/JKtclTrar/GHWvHbCizqfk5mBSDpZqGPZsjIrRSqMRVSoo/QrOwZPDOrNrzdcI8B8D/JU=" id="OWA519a87a8-553b-c8b2-a366-a8df9ed4589e" class="x_x_x_x_OWAAutoLink" data-auth="NotApplicable" data-loopstyle="linkonly">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fwindows%2Fwin32%2FSecAuthZ%2Forder-of-aces-in-a-dacl&data=05%7C02%7Csrenaden%40microsoft.com%7Cfe0af73840584248d61808dc6ef382d9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638507239378695121%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=CBrpNXxW1LpEgR2JCm5L6R0YLhld1DYAkYC8dFX43LE%3D&reserved=0</a><br>
<br>
> The following steps describe the preferred order:<br>
><br>
> 1. All explicit ACEs are placed in a group before any inherited ACEs.<br>
><br>
> 2. Within the group of explicit ACEs, access-denied ACEs are placed before<br>
> access-allowed ACEs.<br>
><br>
> 3. Inherited ACEs are placed in the order in which they are inherited. ACEs<br>
> inherited from the child object's parent come first, then ACEs inherited from<br>
> the grandparent, and so on up the tree of objects.<br>
><br>
> 4. For each level of inherited ACEs, access-denied ACEs are placed before<br>
> access-allowed ACEs.<br>
<br>
the inherited ACEs are placed in stripes like of DENY and ALLOW ACEs,<br>
like tree rings. This is not part of the definition in MS-DTYP, which<br>
only says "inherited ACEs are placed in the order in which they were<br>
inherited". Should it be part of MS-DTYP 2.4.5?<br>
<br>
Of course, when looking at a DACL in isolation, there is no way of<br>
knowing where the inherited ACEs were inherited from, so the question is<br>
kind of moot. Maybe that is why MS-DTYP doesn't want to say much, and<br>
why the MS-ADTS algorithm just flattens the inheritance, potentially<br>
changing the outcome (by bringing a grandparent DENY in front of a<br>
parent ALLOW).<br>
<br>
I'll note there are a wide range of formulations of canonicity, from<br>
Microsoft and elsewhere, not all of which can be compatible. For<br>
example,<br>
<a href="https://learn.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.commonacl?view=net-8.0" originalsrc="https://learn.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.commonacl?view=net-8.0" shash="QSso+ydnjdULSgFARiryodiak0MsXocMQ/D09gdY7sFN8ObjaS4gTbdk7JwywOFqDLrSrAQ9wZBow66DaLKmlX50/nIUUT7AyeXjzG1nR0Zz0i8ojJ7UmntF3iWdKDiOyk2EMBB4y6+9vB2ZFyfTGfc+MJr3OXrXUwX17Tqg8QI=" originalsrc="https://learn.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.commonacl?view=net-8.0" shash="uUsF53OPFjrmdk4w35m4G/r6T6bNhrItpAD1FiDZym84/7FxeT4hJIoujPu6t3kwxB0JVC8IDiZ7aaHXIg0LpHx7CdUYdehJPY0RHNcL3nfP1nj+GZjQdVj+bqYvcGlWc0syiurEGzBgBSdd2kthOil6Mxkw7wj97YyP2jKZTJA=" id="OWAb65da879-53aa-1354-8078-19385d3f176e" class="x_x_x_x_OWAAutoLink" data-auth="NotApplicable" data-loopstyle="linkonly">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fdotnet%2Fapi%2Fsystem.security.accesscontrol.commonacl%3Fview%3Dnet-8.0&data=05%7C02%7Csrenaden%40microsoft.com%7Cfe0af73840584248d61808dc6ef382d9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638507239378701549%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=pfebzEmURR5OTZQD%2B1JkZVW1KzYXj%2BmJO%2BVe%2Fvt3Rzc%3D&reserved=0</a><br>
would not sort the ACEs lexicographically, but by SID.<br>
<br>
Do SACLs have a canonical ordering, beyond having explicit ACEs first?<br>
<br>
cheers,<br>
Douglas</div>
</div>
</body>
</html>