Make sure that we only propogate the INHERITED flag when we are allowed to.

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Richard Sharpe <realrichardsharpe@gmail.com>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Mar 28 19:43:41 CET 2013 on sn-devel-104

diff --git a/libcli/security/secdesc.c b/libcli/security/secdesc.c
index d2c58334927592becd7524c6f73724f84452b817..a7e99005ebec6ca1ac1cf004834c0aed97792e05 100644 (file)
--- a/libcli/security/secdesc.c
+++ b/libcli/security/secdesc.c
@@ -614,7 +614,8 @@ NTSTATUS se_create_child_secdesc(TALLOC_CTX *ctx,
                if (!container) {
                        new_flags = 0;
                } else {
-                       new_flags &= ~SEC_ACE_FLAG_INHERIT_ONLY;
+                       new_flags &= ~(SEC_ACE_FLAG_INHERIT_ONLY
+                                       | SEC_ACE_FLAG_INHERITED_ACE);
 
                        if (!(new_flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
                                new_flags |= SEC_ACE_FLAG_INHERIT_ONLY;