Win2K08 does not like the order in which we add inheritable ACEs in modules/vfs_acl_common.c:add_acl_inheritable_components
jerry at plainjoe.org
Sat Mar 31 12:28:11 MDT 2012
On 3/30/2012 3:20 PM, Richard Sharpe wrote:
> From observing what W2K08 does and having tweaked the code, it seems
> pretty clear that the inheritable entries added should come first.
> I still have to test that W2K03 is happy, though, and should probably
> look at Win7.
Are you sure about that?
"The preferred order of ACEs in a DACL is called the canonical order.
For Windows 2000, the canonical order is the following:
* All explicit ACEs are placed in a group before any inherited ACEs.
* Within the group of explicit ACEs, access-denied ACEs are
placed before access-allowed ACEs.
* Inherited ACEs are placed in the order in which they are
inherited. ACEs inherited from the child object's parent come
first, then ACEs inherited from the grandparent, and so on
up the tree of objects."
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 251 bytes
Desc: OpenPGP digital signature
More information about the samba-technical