Bug 8621 - ACL are not recalculated if parent is changed and inherit is enabled
Summary: ACL are not recalculated if parent is changed and inherit is enabled
Alias: None
Product: Samba 4.0
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: unspecified
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: samba4-qa@samba.org
Depends on: 8620
Blocks: 8622
  Show dependency treegraph
Reported: 2011-11-18 14:11 UTC by Matthieu Patou
Modified: 2019-11-06 04:46 UTC (History)
2 users (show)

See Also:

Patches for v4-0-test (82.90 KB, patch)
2012-12-03 10:18 UTC, Stefan Metzmacher
obnox: review+

Note You need to log in before you can comment on or make changes to this bug.
Description Matthieu Patou 2011-11-18 14:11:39 UTC
Let's suppose we have the following OU: OU=Test,DC=Domain,DC=tld which grants create child right to group "Domain Users" but not to write.

Any user can create an object in this OU, once created object can't be deleted by the user due to default ACL inheritance.

Let's suppose that you then modify the ACL of the OU to grants to this group the right to write objects. On windows I'll have the right to delete or modify the object, on samba I don't.
Comment 1 Karolin Seeger 2012-11-06 10:53:15 UTC
Re-assigning to Metze.
Comment 2 Stefan Metzmacher 2012-11-19 15:17:20 UTC
I have some patches, which fix it for originating updates.


The patches need some cleanup and nTSecurityDescriptor recalculation
on incoming replication is still missing. But the current passes autobuild,
including some new tests (SdAutoInheritTests)
Comment 3 Stefan Metzmacher 2012-12-03 10:18:00 UTC
Created attachment 8257 [details]
Patches for v4-0-test

Depends on https://bugzilla.samba.org/attachment.cgi?id=8256
Comment 4 Michael Adam 2012-12-03 11:54:45 UTC
Comment on attachment 8257 [details]
Patches for v4-0-test

Comment 5 Michael Adam 2012-12-03 11:55:04 UTC
==> Karolin for 4.0
Comment 6 Karolin Seeger 2012-12-03 12:19:51 UTC
Pushed to autobuild-v4-0-test.
Comment 7 Karolin Seeger 2012-12-03 19:29:59 UTC
Pushed to v4-0-test.
Closing out bug report.