s3:utils: Fix Inherit-Only flag being automatically propagated to children

Inherit-only flag applies only to the container it was set to and it
shouldn't be automatically propagated to children.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15636

Signed-off-by: Anna Popova <popova.anna235@gmail.com>
Reviewed-by: Noel Power <noel.power@suse.com>
Reviewed-by: Ralph Boehme <slow@samba.org>

diff --git a/selftest/knownfail.d/smbcacls b/selftest/knownfail.d/smbcacls
deleted file mode 100644 (file)
index 5e201df..0000000
--- a/selftest/knownfail.d/smbcacls
+++ /dev/null
@@ -1,6 +0,0 @@
-^samba.tests.blackbox.smbcacls_propagate_inhertance.samba.tests.blackbox.smbcacls_propagate_inhertance.InheritanceSmbCaclsTests.test_simple_iocioi_add
-^samba.tests.blackbox.smbcacls_propagate_inhertance.samba.tests.blackbox.smbcacls_propagate_inhertance.InheritanceSmbCaclsTests.test_simple_ioci_add
-^samba.tests.blackbox.smbcacls_dfs_propagate_inherit\(DFS-msdfs-root\).samba.tests.blackbox.smbcacls_propagate_inhertance.InheritanceSmbCaclsTests.test_simple_iocioi_add
-^samba.tests.blackbox.smbcacls_dfs_propagate_inherit\(DFS-msdfs-root\).samba.tests.blackbox.smbcacls_propagate_inhertance.InheritanceSmbCaclsTests.test_simple_ioci_add
-^samba.tests.blackbox.smbcacls_dfs_propagate_inherit\(DFS-msdfs-root\).samba.tests.blackbox.smbcacls_dfs_propagate_inherit.DfsInheritanceSmbCaclsTests.test_simple_iocioi_add
-^samba.tests.blackbox.smbcacls_dfs_propagate_inherit\(DFS-msdfs-root\).samba.tests.blackbox.smbcacls_dfs_propagate_inherit.DfsInheritanceSmbCaclsTests.test_simple_ioci_add
\ No newline at end of file

diff --git a/source3/utils/smbcacls.c b/source3/utils/smbcacls.c
index 708e03a120a96e6bead45115a07273f955354d71..fb654e0cf1bb8df9a632a1877a7fa178f2460e9f 100644 (file)
--- a/source3/utils/smbcacls.c
+++ b/source3/utils/smbcacls.c
@@ -916,6 +916,10 @@ static uint8_t get_flags_to_propagate(bool is_container,
        /* Assume we are not propagating the ACE */
 
        newflags &= ~SEC_ACE_FLAG_INHERITED_ACE;
+
+       /* Inherit-only flag is not propagated to children */
+
+       newflags &= ~SEC_ACE_FLAG_INHERIT_ONLY;
        /* all children need to have the SEC_ACE_FLAG_INHERITED_ACE set */
        if (acl_cntrinherit || acl_objinherit) {
                /*