[prev in list] [next in list] [prev in thread] [next in thread]
List: cifs-protocol
Subject: Re: [cifs-protocol] Question about MS-DTYP 2.5.3.4 Algorithm for
From: Edgar Olougouna <edgaro () microsoft ! com>
Date: 2011-02-10 22:25:10
Message-ID: C3D5BF8228FEF54BABF69D7E1088B85F5696C2D6 () TK5EX14MBXC117 ! redmond ! corp ! microsoft ! com
[Download RAW message or body]
Nadya,
I am researching this and will update you as soon as I have news.
Regards,
Edgar
From: didrash@gmail.com [mailto:didrash@gmail.com] On Behalf Of Nadezhda Iv=
anova
Sent: Wednesday, February 09, 2011 8:04 AM
To: Interoperability Documentation Help; cifs-protocol@samba.org
Subject: Question about MS-DTYP 2.5.3.4 Algorithm for Creating a Security D=
escriptor
Hi,
I have a question regarding 2.5.3.4 Algorithm for Creating a Security Desc=
riptor.
It is said there that any ACEs provided by the user that contain the INHERI=
TED_ACE flag are not included in the final SD assigned to the object, and i=
n the algorithm they are also disregarded. This is indeed the behavior I ob=
served.
I created a group, providing this security descriptor during creation:
"D:(A;ID;WP;;;AU)"
When I read the SD of the object back, it read O:DAG:DUD:AIS:AI(OU;CIIOIDSA=
;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049=
e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11=
d0-a285-00aa003049e2;WD)
It had no DACL, as expected.
However, when I performed the same test with a very small change, creating =
the object with this SD - "D:P(A;ID;WP;;;AU)"
The resulted SD is: O:DAG:DUD:PAI(A;;WP;;;AU)S:AI(OU;CIIOIDSA;WP;f30e3bbe-9=
ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIO=
IDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa00=
3049e2;WD)
So, it turns out that ACEs with INHERITED_ACE flag provided by the user are=
not ignored if we break the inheritance at that object. I haven't found in=
the docs where this is specified, however. Is this a desired behavior?
I am testing against win2003R2
Regards,
Nadya
[Attachment #3 (text/html)]
<html xmlns:v="urn:schemas-microsoft-com:vml" \
xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" \
xmlns="http://www.w3.org/TR/REC-html40"> <head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Nadya,<o:p></o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I \
am researching this and will update you as soon as I have news.<o:p></o:p></span></p> \
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Edgar<o:p></o:p></span></p>
<p class="MsoNormal"><span \
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span \
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span \
style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> \
didrash@gmail.com [mailto:didrash@gmail.com] <b>On Behalf Of </b>Nadezhda Ivanova<br>
<b>Sent:</b> Wednesday, February 09, 2011 8:04 AM<br>
<b>To:</b> Interoperability Documentation Help; cifs-protocol@samba.org<br>
<b>Subject:</b> Question about MS-DTYP 2.5.3.4 Algorithm for Creating a Security \
Descriptor<o:p></o:p></span></p> <p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi,<br>
I have a question regarding 2.5.3.4 Algorithm for Creating a Security \
Descriptor.<br> <br>
It is said there that any ACEs provided by the user that contain the INHERITED_ACE \
flag are not included in the final SD assigned to the object, and in the algorithm \
they are also disregarded. This is indeed the behavior I observed.<br> I created a \
group, providing this security descriptor during creation: <br> \
"D:(A;ID;WP;;;AU)"<br> When I read the SD of the object back, it read \
O:DAG:DUD:AIS:AI(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d \
0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)<br>
It had no DACL, as expected.<br>
<br>
However, when I performed the same test with a very small change, creating the object \
with this SD - "D:P(A;ID;WP;;;AU)"<br> The resulted SD is: \
O:DAG:DUD:PAI(A;;WP;;;AU)S:AI(OU;CIIOIDSA;WP;f30e3bbe-9ff0-11d1-b603-0000f80367c1;bf96 \
7aa5-0de6-11d0-a285-00aa003049e2;WD)(OU;CIIOIDSA;WP;f30e3bbf-9ff0-11d1-b603-0000f80367c1;bf967aa5-0de6-11d0-a285-00aa003049e2;WD)<br>
<br>
So, it turns out that ACEs with INHERITED_ACE flag provided by the user are not \
ignored if we break the inheritance at that object. I haven't found in the docs where \
this is specified, however. Is this a desired behavior?<br> <br>
I am testing against win2003R2<br>
<br>
Regards,<br>
Nadya<o:p></o:p></p>
</div>
</body>
</html>
_______________________________________________
cifs-protocol mailing list
cifs-protocol@cifs.org
https://lists.samba.org/mailman/listinfo/cifs-protocol
--===============2951927165964814061==--
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic