<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Douglas,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Could you let us know a bit more about how this relates to what you're working on? </div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
It appears to me that the documentation sufficiently covers your question #3. We document that inherited ACEs must be kept in the order they are inherited. Since each parent orders their explicit ACEs before their inherited ACEs, the ACEs are already in canonical
order coming from the parent. The directive to maintain the order in which they were inherited means they need to be kept in the same order coming from the parent. This will preserve the parent/grandparent ordering without needing to identify which ACEs come
from the parent and which come from the grandparent. </div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Arial, sans-serif; font-size: 10pt; color: blue;">
Best regards,</div>
<div class="elementToProof" style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<span style="color: navy;"><b><i>Jeff M</i></b></span><span style="color: rgb(0, 32, 96);"><b><i><sup>c</sup></i></b></span><span style="color: navy;"><b><i>Cashland (He/him)
</i>| Senior Escalation Engineer | Microsoft Corporation</b></span></div>
<div id="Signature">
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Arial, sans-serif; font-size: 9pt; color: blue;">Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada)</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Arial, sans-serif; font-size: 8pt; color: blue;">Local country phone number found here:
<u><a href="http://support.microsoft.com/globalenglish" id="OWAf9621735-ebe1-7bf0-8256-6545cdba288a" class="OWAAutoLink" data-loopstyle="linkonly" style="color: blue; margin-top: 0px; margin-bottom: 0px;">http://support.microsoft.com/globalenglish</a></u> |
Extension 1138300</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"> </p>
</div>
<div id="appendonsend"></div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg" dir="ltr"><span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Jeff McCashland (He/him) <jeffm@microsoft.com><br>
<b>Sent:</b> Wednesday, May 8, 2024 11:11 AM<br>
<b>To:</b> Douglas Bagnall <douglas.bagnall@catalyst.net.nz><br>
<b>Cc:</b> cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org>; Sreekanth Nadendla <srenaden@microsoft.com><br>
<b>Subject:</b> Re: [MS-DTYP] canonical ACL sort order Q3 - TrackingID#2405080040008240</span>
<div> </div>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Douglas,</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I will research your question and let you know what I find. </div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_Signature">
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Arial, sans-serif; font-size: 10pt; color: blue;">Best regards,</span><span style="font-family: Arial, sans-serif; font-size: 10pt; color: navy;"><b><br>
<i>Jeff M</i></b></span><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 32, 96);"><b><i><sup>c</sup></i></b></span><span style="font-family: Arial, sans-serif; font-size: 10pt; color: navy;"><b><i>Cashland (He/him)
</i>| Senior Escalation Engineer | Microsoft Corporation</b></span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Arial, sans-serif; font-size: 9pt; color: blue;">Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada)</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"><span style="font-family: Arial, sans-serif; font-size: 8pt; color: blue;">Local country phone number found here:
<u><a href="http://support.microsoft.com/globalenglish" id="OWAdeeb4116-37e1-c063-a459-a086491b4e2c" class="OWAAutoLink" data-auth="NotApplicable" data-loopstyle="linkonly" style="color: blue; margin-top: 0px; margin-bottom: 0px;">http://support.microsoft.com/globalenglish</a></u> |
Extension 1138300</span></p>
<p style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"> </p>
</div>
<div id="x_appendonsend"></div>
<hr style="direction: ltr; display: inline-block; width: 98%;">
<div id="x_divRplyFwdMsg" dir="ltr"><span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Sreekanth Nadendla <srenaden@microsoft.com><br>
<b>Sent:</b> Wednesday, May 8, 2024 8:51 AM<br>
<b>To:</b> Douglas Bagnall <douglas.bagnall@catalyst.net.nz><br>
<b>Cc:</b> cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
<b>Subject:</b> [MS-DTYP] canonical ACL sort order Q3 - TrackingID#2405080040008240</span>
<div> </div>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div id="x_x_x_divRplyFwdMsg" dir="ltr"></div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Dochelp in Bcc</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello Douglas, this e-mail thread will be used to track the investigation for the following issue</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>ISSUE:</b></div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
MS-DTYP definition says little about the ordering of DENY and ALLOW ACEs in the inherited sections. In places where canonical</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
ACLs are constructed, such as</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fwindows%2Fwin32%2FSecAuthZ%2Forder-of-aces-in-a-dacl&data=05%7C02%7Csrenaden%40microsoft.com%7Cfe0af73840584248d61808dc6ef382d9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638507239378695121%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=CBrpNXxW1LpEgR2JCm5L6R0YLhld1DYAkYC8dFX43LE%3D&reserved=0</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> The following steps describe the preferred order:</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
></div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> 1. All explicit ACEs are placed in a group before any inherited ACEs.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
></div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> 2. Within the group of explicit ACEs, access-denied ACEs are placed before</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> access-allowed ACEs.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
></div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> 3. Inherited ACEs are placed in the order in which they are inherited. ACEs</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> inherited from the child object's parent come first, then ACEs inherited from</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> the grandparent, and so on up the tree of objects.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
></div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> 4. For each level of inherited ACEs, access-denied ACEs are placed before</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
> access-allowed ACEs.</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
the inherited ACEs are placed in stripes like of DENY and ALLOW ACEs,</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
like tree rings. This is not part of the definition in MS-DTYP, which</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
only says "inherited ACEs are placed in the order in which they were</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
inherited". <b>Should it be part of MS-DTYP 2.4.5?</b></div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Of course, when looking at a DACL in isolation, there is no way of</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
knowing where the inherited ACEs were inherited from, so the question is</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
kind of moot. Maybe that is why MS-DTYP doesn't want to say much, and</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
why the MS-ADTS algorithm just flattens the inheritance, potentially</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
changing the outcome (by bringing a grandparent DENY in front of a</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
parent ALLOW).</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="x_x_x_x_Signature">
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 15px; color: black;">Regards,</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 15px; color: black;">Sreekanth Nadendla</span></p>
<p style="margin-top: 0px; margin-bottom: 0px;"><span style="font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 15px; color: black;">Microsoft Windows Open
Specifications</span></p>
</div>
<div id="x_x_x_x_appendonsend"></div>
<div style="direction: ltr; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="direction: ltr; display: inline-block; width: 98%;">
<div id="x_x_x_x_divRplyFwdMsg" dir="ltr" class="x_x_x_x_elementToProof x_x_x_elementToProof x_x_elementToProof">
<span style="font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> Douglas Bagnall <douglas.bagnall@catalyst.net.nz><br>
</span></div>
<div style="direction: ltr; font-family: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<b>Sent:</b> Tuesday, May 7, 2024 8:11 PM<br>
<b>To:</b> Interoperability Documentation Help <dochelp@microsoft.com>; cifs-protocol@lists.samba.org <cifs-protocol@lists.samba.org><br>
<b>Subject:</b> [EXTERNAL] [MS-DTYP] canonical ACL sort order</div>
<div style="direction: ltr;"> </div>
<div style="direction: ltr; font-size: 11pt;">hi Dochelp.<br>
<br>
I have questions about the definition of the canonical ACL form, to do<br>
with the status of callback ACEs and the ordering of inherited ACEs.<br>
<br>
MS-DTYP 2.4.5 says:<br>
<br>
> An ACL is said to be in canonical form if:<br>
><br>
> * All explicit ACEs are placed before inherited ACEs.<br>
><br>
> * Within the explicit ACEs, deny ACEs come before grant ACEs.<br>
><br>
> * Deny ACEs on the object come before deny ACEs on a child or property.<br>
><br>
> * Grant ACEs on the object come before grant ACEs on a child or property.<br>
><br>
> * Inherited ACEs are placed in the order in which they were inherited.<br>
<br>
I think the third and fourth clauses are talking about the OBJECT ACE<br>
types, saying that e.g. ACCESS_ALLOWED_OBJECT_ACE_TYPE comes after<br>
ACCESS_ALLOWED_ACE_TYPE. But is it also talking about ACEs with the<br>
INHERIT_ONLY_ACE flag? Or some other mechanism?<br>
<br>
Logically it would seem that callback ACEs should be placed is a similar<br>
position to the OBJECT ones.<br>
<br>
Relevantly, MS-ADTS 6.1.3.1 says:<br>
<br>
> ACE ordering rules apply only to ACLs in canonical form (see [MS-DTYP]<br>
> section 2.4.5), and only when the forest functional level is<br>
> DS_BEHAVIOR_WIN2003 or above. The following rules are applied, in the<br>
> following order:<br>
><br>
> 1. Explicit ACEs come before inherited ACEs.<br>
><br>
> 2. Deny ACEs come before Allow ACEs.<br>
><br>
> 3. Regular ACEs come before object ACEs.<br>
><br>
> 4. Within each group, the ACEs are ordered lexicographically (that is, based on<br>
> octet string comparison rules).<br>
><br>
> Rules 3 and 4 above are enforced only when the forest functional level is<br>
> DS_BEHAVIOR_WIN2003 or above. Otherwise, the order of ACEs within each group<br>
> defined by rules 1 and 2 is retained as supplied by the user or replication<br>
> partner.<br>
<br>
Point 4 (sorting "lexicographically" via binary comparison), would sort<br>
the ACE structures primarily by ACE type, followed by flags, followed by<br>
the type specific members (often the SID is next).<br>
<br>
That would put the DENY ACEs in this order:<br>
<br>
ACCESS_DENIED_ACE_TYPE (1)<br>
ACCESS_DENIED_OBJECT_ACE_TYPE (6)<br>
ACCESS_DENIED_CALLBACK_ACE_TYPE (10)<br>
ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE (12)<br>
<br>
and similarly for the ALLOW ACEs. But by rule 3, we already have put<br>
"regular" ACEs before object ACEs, so if callback ACEs count as regular,<br>
we'd end up with<br>
<br>
ACCESS_DENIED_ACE_TYPE (1)<br>
ACCESS_DENIED_CALLBACK_ACE_TYPE (10)<br>
ACCESS_DENIED_OBJECT_ACE_TYPE (6)<br>
ACCESS_DENIED_CALLBACK_OBJECT_ACE_TYPE (12)<br>
<br>
Are one of these orderings considered to be part of the canonical form?<br>
<br>
Either would be consistent with my understanding of MS-DTYP 2.4.5 with<br>
respect to plain and object ACEs.<br>
<br>
(As far as I can tell, the ordering within a block of DENY or ALLOW ACEs<br>
doesn't matter with respect to the eventual outcome, but putting the<br>
fancy kinds at the back is likely to be more efficient as it might avoid<br>
the extra work they entail).<br>
<br>
Also I note the MS-DTYP definition says little about the ordering of<br>
DENY and ALLOW ACEs in the inherited sections. In places where canonical<br>
ACLs are constructed, such as<br>
<br>
<a href="https://learn.microsoft.com/en-us/windows/win32/SecAuthZ/order-of-aces-in-a-dacl" id="OWAd7eae54e-642d-0bca-e6ec-a0d383028715" class="x_x_x_x_OWAAutoLink" shash="xK2tvSgDFqHjH14CT0gquR177MevAzV5LTAaYgI4B9ukkZPB4Qiv8Ws++N2uYDUsYKTdQspi2PTMpTHYZLSFH1vswa7HWH76oG97KDEuMcbBDJPwAo8v+zgRu4E2OukyH1qkvNYG458xOzaFYjqGVletjUQIm7fz5SM3VBWhbHE=" originalsrc="https://learn.microsoft.com/en-us/windows/win32/SecAuthZ/order-of-aces-in-a-dacl" data-auth="Verified" data-loopstyle="linkonly">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fwindows%2Fwin32%2FSecAuthZ%2Forder-of-aces-in-a-dacl&data=05%7C02%7Csrenaden%40microsoft.com%7Cfe0af73840584248d61808dc6ef382d9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638507239378695121%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=CBrpNXxW1LpEgR2JCm5L6R0YLhld1DYAkYC8dFX43LE%3D&reserved=0</a><br>
<br>
> The following steps describe the preferred order:<br>
><br>
> 1. All explicit ACEs are placed in a group before any inherited ACEs.<br>
><br>
> 2. Within the group of explicit ACEs, access-denied ACEs are placed before<br>
> access-allowed ACEs.<br>
><br>
> 3. Inherited ACEs are placed in the order in which they are inherited. ACEs<br>
> inherited from the child object's parent come first, then ACEs inherited from<br>
> the grandparent, and so on up the tree of objects.<br>
><br>
> 4. For each level of inherited ACEs, access-denied ACEs are placed before<br>
> access-allowed ACEs.<br>
<br>
the inherited ACEs are placed in stripes like of DENY and ALLOW ACEs,<br>
like tree rings. This is not part of the definition in MS-DTYP, which<br>
only says "inherited ACEs are placed in the order in which they were<br>
inherited". Should it be part of MS-DTYP 2.4.5?<br>
<br>
Of course, when looking at a DACL in isolation, there is no way of<br>
knowing where the inherited ACEs were inherited from, so the question is<br>
kind of moot. Maybe that is why MS-DTYP doesn't want to say much, and<br>
why the MS-ADTS algorithm just flattens the inheritance, potentially<br>
changing the outcome (by bringing a grandparent DENY in front of a<br>
parent ALLOW).<br>
<br>
I'll note there are a wide range of formulations of canonicity, from<br>
Microsoft and elsewhere, not all of which can be compatible. For<br>
example,<br>
<a href="https://learn.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.commonacl?view=net-8.0" id="OWAac601d58-dcb8-d2d1-c308-3b92cb4b0a83" class="x_x_x_x_OWAAutoLink" shash="o5K+wcI8OZRuaMTkh16yslN7ouIJpAaJnK4WktXlfxP/SIKTboWtXyHYW4PoBrhM9Ua5P/R7p5eMBg05p3xNg0Z7se+dVTqARYzoY42qx3ygA7RzyKH9HEbQ4scaN+81lOBMPJaSVoOobFokZTh1M4cTZjKQPCYcMRpZyi4bOSE=" originalsrc="https://learn.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.commonacl?view=net-8.0" data-auth="Verified" data-loopstyle="linkonly">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fdotnet%2Fapi%2Fsystem.security.accesscontrol.commonacl%3Fview%3Dnet-8.0&data=05%7C02%7Csrenaden%40microsoft.com%7Cfe0af73840584248d61808dc6ef382d9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638507239378701549%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=pfebzEmURR5OTZQD%2B1JkZVW1KzYXj%2BmJO%2BVe%2Fvt3Rzc%3D&reserved=0</a><br>
would not sort the ACEs lexicographically, but by SID.<br>
<br>
Do SACLs have a canonical ordering, beyond having explicit ACEs first?<br>
<br>
cheers,<br>
Douglas</div>
</body>
</html>