I need to be able to force an empty DACL on an object under Windows ...

[Richard Sharpe]

On Wed, Mar 28, 2012 at 7:06 PM, Richard Sharpe
<realrichardsharpe at gmail.com> wrote:
> On Wed, Mar 28, 2012 at 12:40 PM, Richard Sharpe
> <realrichardsharpe at gmail.com> wrote:
>> On 3/28/12, Volker Lendecke <Volker.Lendecke at sernet.de> wrote:
>>> On Wed, Mar 28, 2012 at 11:18:24AM -0700, Richard Sharpe wrote:
>>>> Hi folks,
>>>>
>>>> I needed to force an empty DACL on files on Windows, so I created this
>>>> small patch to smbcacls.
>>>>
>>>> Is it of use to anyone else? If so, I could push it to the master
>>>> branch after any cleanups suggested by people.
>>>
>>> Can you do the same for sacls?
>>
>> Sure, but what is the meaning of a NULL SACL with the SACL_PRESENT bit
>> set in the SD?
>
> I guess that from our point of view, having the ability to set a NULL
> SACL will allow us to explore the meaning, so I will add that ability
> as well.

It turns out that smbcacls knows nothing really about SACLs, so this
will not be all that easy. Would probably require a re-design of
smbcacls.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)