The checks for OI and CI were just wrong.... Fix them. Thanks to

Jim for testing this.
Jeremy.

diff --git a/source/smbd/posix_acls.c b/source/smbd/posix_acls.c
index f46d6f65185a2723c3a290f5d84050ca300d5456..a62fe6c75df38978a3fb80739c540e4fa23df01c 100644 (file)
--- a/source/smbd/posix_acls.c
+++ b/source/smbd/posix_acls.c
@@ -3190,20 +3190,15 @@ static NTSTATUS append_parent_acl(files_struct *fsp,
        /* Finally append any inherited ACEs. */
        for (j = 0; j < parent_sd->dacl->num_aces; j++) {
                SEC_ACE *se = &parent_sd->dacl->aces[j];
-               uint32 i_flags = se->flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
-                                       SEC_ACE_FLAG_CONTAINER_INHERIT|
-                                       SEC_ACE_FLAG_INHERIT_ONLY);
 
                if (fsp->is_directory) {
-                       if (i_flags == SEC_ACE_FLAG_OBJECT_INHERIT) {
-                               /* Should only apply to a file - ignore. */
+                       if (!(se->flags & SEC_ACE_FLAG_CONTAINER_INHERIT)) {
+                               /* Doesn't apply to a directory - ignore. */
                                continue;
                        }
                } else {
-                       if ((i_flags & (SEC_ACE_FLAG_OBJECT_INHERIT|
-                                       SEC_ACE_FLAG_INHERIT_ONLY)) !=
-                                       SEC_ACE_FLAG_OBJECT_INHERIT) {
-                               /* Should not apply to a file - ignore. */
+                       if (!(se->flags & SEC_ACE_FLAG_OBJECT_INHERIT)) {
+                               /* Doesn't apply to a file - ignore. */
                                continue;
                        }
                }