--- modules/vfs_acl_common.c.orig 2012-05-29 11:06:31.696878464 -0700 +++ modules/vfs_acl_common.c 2012-05-29 12:07:02.485802955 -0700 @@ -453,7 +453,56 @@ if (!inheritable_components && !inherit_owner) { /* Nothing to inherit and not setting owner. */ - return NT_STATUS_OK; + /* + * So, we mimic the Windows behavior. That is, we create + * AN SD with the user as the owner, group as group owner + * and two ACEs with full access allowed as below + */ + size_t sd_size = 0; + SEC_ACL *dacl = NULL; + SEC_ACE aces[2]; + + DEBUG(10, ("Creating default ACL because no inheritable ACEs available\n")); + /* First an ACE giving creator all access */ + init_sec_ace(&aces[0], + &handle->conn->server_info->ptok->user_sids[PRIMARY_USER_SID_INDEX], + SEC_ACE_TYPE_ACCESS_ALLOWED, + GENERIC_RIGHTS_FILE_ALL_ACCESS, + 0x0); + + init_sec_ace(&aces[1], + &global_sid_System, + SEC_ACE_TYPE_ACCESS_ALLOWED, + GENERIC_RIGHTS_FILE_ALL_ACCESS, + 0x0); + + dacl = make_sec_acl(ctx, NT4_ACL_REVISION, 2, aces); + if (!dacl) { + DEBUG(10, ("Failed to make default DACL, out of memory!\n")); + return NT_STATUS_NO_MEMORY; + } + + psd = make_sec_desc(ctx, + SEC_DESC_REVISION, + SEC_DESC_SELF_RELATIVE, + &handle->conn->server_info->ptok->user_sids[PRIMARY_USER_SID_INDEX], + &handle->conn->server_info->ptok->user_sids[PRIMARY_GROUP_SID_INDEX], + NULL, /* Empty SACL */ + dacl, /* DACL with above entries */ + &sd_size); + + if (!psd) { + DEBUG(10, ("Failed to create SD, out of memory!\n")); + return NT_STATUS_NO_MEMORY; + } + + /* Now, store it ... */ + + status = SMB_VFS_FSET_NT_ACL(fsp, + security_info_sent, + psd); + + return status; } /* Create an inherited descriptor from the parent. */