Subject: RE: Speaking of ACLs

From: [email-masked]
Date: Wed, 10 Apr 2002 17:25:15 -0400

Perhaps with NT, but that's not the behavior I see with Win2K.  If I create
a file within a folder that propagates permissions, I can tell which
permissions on the file were inherited and which are explicit.  They display
differently when you right click, select Properties and look at the Security
tab.  Inherited permissions have a gray background, so they must keep track
of it somehow.  Also, if I change the inheritable permissions on the parent
directory, that shows through automatically to the child.  On NT, it would
just push the ACL changes through by explicitly setting the new stuff on
files.  Win2K doesn't seem to do that.

-----Original Message-----
From: Carl Beame [mailto:[email-masked]]
Sent: Wednesday, April 10, 2002 5:13 PM
To: [email-masked]; [email-masked]; [email-masked];
[email-masked]; [email-masked]
Subject: RE: Speaking of ACLs

On Wed Apr 10 22:03:50 2002,  wrote:
  I want
> to
> craft an ACL that allows and denies the right set of accesses to the
> right
> set of people and apply it to a directory structure just once.  So,
> imagine
> I create a directory for some engineering project and deny access to
> the
> Marketing group so they don't tell customers about something too soon.
>  At
> some point, I might have a file in the directory structure that I want
> a
> Marketing person to read.  Therefore, I'll add an ACL entry that
> allows that
> Marketing person read access to the file.  Since this is an explicit
> ACE, it
> takes precedence over the inherited ACE that would have denied access.

Not true! The file which you want to allow access when it is created
will have an ORDINARY ACE which prohibits access to the Marketing
Department. To change this you use Microsofts tools which below the
surface will read the existing ACEs and add an ALLOW ACE for the
Marketing person before the ACE for disallowing the Marketing
Departmant and then rewrite the ACL to disk.

> 
> The idea of ACLs automatically propagating through a directory
> structure is
> appealing, the question is in how it's handled.  When POSIX did it, an
> inherited ACL because just like any other ACL entry (as I recall). 
> When
> Microsoft did it, they keep track of explicit versus inherited.  
> They  may
> actually compute the inherited ACEs on-the-fly, I don't know.

No.  ACEs on parent directories have NO bearing on the ACE of the
file. The only time it does is at the instant of creation. If a client
NFS wants to set a specific ACE on a newly created file it should read
the ACEs from the file just after creation to see what inherited ACEs
the server gave it.

- Carl

---

From: Guy Harris <[email-masked]>
Date: Wed, 10 Apr 2002 14:34:56 -0700

On Wed, Apr 10, 2002 at 05:25:15PM -0400, [email-masked] wrote:
> On NT, it would

The article at

	http://support.microsoft.com/default.aspx?scid=kb;en-us;Q231903

might give some useful information here.

See also

	http://support.microsoft.com/default.aspx?scid=kb;EN-US;q287024

and the other knowledge base articles to which it refers.