s3:utils: Fix Inherit-Only flag being automatically propagated to children

Inherit-only flag applies only to the container it was set to and it
shouldn't be automatically propagated to children.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15636

Signed-off-by: Anna Popova <popova.anna235@gmail.com>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Mon Apr 29 10:56:48 UTC 2024 on atb-devel-224

diff --git a/selftest/knownfail.d/smbcacls b/selftest/knownfail.d/smbcacls
deleted file mode 100644 (file)
index 5e201df..0000000
--- a/selftest/knownfail.d/smbcacls
+++ /dev/null
@@ -1,6 +0,0 @@
-^samba.tests.blackbox.smbcacls_propagate_inhertance.samba.tests.blackbox.smbcacls_propagate_inhertance.InheritanceSmbCaclsTests.test_simple_iocioi_add
-^samba.tests.blackbox.smbcacls_propagate_inhertance.samba.tests.blackbox.smbcacls_propagate_inhertance.InheritanceSmbCaclsTests.test_simple_ioci_add
-^samba.tests.blackbox.smbcacls_dfs_propagate_inherit\(DFS-msdfs-root\).samba.tests.blackbox.smbcacls_propagate_inhertance.InheritanceSmbCaclsTests.test_simple_iocioi_add
-^samba.tests.blackbox.smbcacls_dfs_propagate_inherit\(DFS-msdfs-root\).samba.tests.blackbox.smbcacls_propagate_inhertance.InheritanceSmbCaclsTests.test_simple_ioci_add
-^samba.tests.blackbox.smbcacls_dfs_propagate_inherit\(DFS-msdfs-root\).samba.tests.blackbox.smbcacls_dfs_propagate_inherit.DfsInheritanceSmbCaclsTests.test_simple_iocioi_add
-^samba.tests.blackbox.smbcacls_dfs_propagate_inherit\(DFS-msdfs-root\).samba.tests.blackbox.smbcacls_dfs_propagate_inherit.DfsInheritanceSmbCaclsTests.test_simple_ioci_add
\ No newline at end of file

diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c
index 2f688290a471ab013a0716511ec7cc354b24c8aa..45f98d36075e66ed57008975f6492ec6d8231f01 100644 (file)
--- a/source3/utils/smbcacls.c
+++ b/source3/utils/smbcacls.c
@@ -921,6 +921,10 @@ static uint8_t get_flags_to_propagate(bool is_container,
        /* Assume we are not propagating the ACE */
 
        newflags &= ~SEC_ACE_FLAG_INHERITED_ACE;
+
+       /* Inherit-only flag is not propagated to children */
+
+       newflags &= ~SEC_ACE_FLAG_INHERIT_ONLY;
        /* all children need to have the SEC_ACE_FLAG_INHERITED_ACE set */
        if (acl_cntrinherit || acl_objinherit) {
                /*