From 187b53e5a5b13b85356a3b564565c45a101690ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20M=C3=BCller?= <michael@fds-team.de>
Date: Wed, 14 Jun 2017 20:20:42 +0200
Subject: [PATCH] server: Do not set SE_{D, S}ACL_PRESENT if no {D, S}ACL was
 set.

Signed-off-by: Matteo Bruni <mbruni@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
---
 dlls/advapi32/tests/security.c |  4 ++--
 server/handle.c                |  2 --
 server/object.c                | 16 ++++++++++++++--
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/dlls/advapi32/tests/security.c b/dlls/advapi32/tests/security.c
index dfc0a23452e..7842d0e2abe 100644
--- a/dlls/advapi32/tests/security.c
+++ b/dlls/advapi32/tests/security.c
@@ -6207,8 +6207,8 @@ static void test_AddMandatoryAce(void)
     present = TRUE;
     ret = GetSecurityDescriptorSacl(sd2, &present, &sacl, &defaulted);
     ok(ret, "GetSecurityDescriptorSacl failed with error %u\n", GetLastError());
-    todo_wine ok(!present, "SACL is present\n");
-    todo_wine ok(sacl == (void *)0xdeadbeef, "SACL is set\n");
+    ok(!present, "SACL is present\n");
+    ok(sacl == (void *)0xdeadbeef, "SACL is set\n");
 
     HeapFree(GetProcessHeap(), 0, sd2);
     CloseHandle(handle);
diff --git a/server/handle.c b/server/handle.c
index faa3a9f1367..35ab8607c85 100644
--- a/server/handle.c
+++ b/server/handle.c
@@ -734,7 +734,6 @@ DECL_HANDLER(get_security_object)
         else
             req_sd.group_len = 0;
 
-        req_sd.control |= SE_SACL_PRESENT;
         sacl = sd_get_sacl( sd, &present );
         if (req->security_info & SACL_SECURITY_INFORMATION && present)
             req_sd.sacl_len = sd->sacl_len;
@@ -747,7 +746,6 @@ DECL_HANDLER(get_security_object)
         else
             req_sd.sacl_len = 0;
 
-        req_sd.control |= SE_DACL_PRESENT;
         dacl = sd_get_dacl( sd, &present );
         if (req->security_info & DACL_SECURITY_INFORMATION && present)
             req_sd.dacl_len = sd->dacl_len;
diff --git a/server/object.c b/server/object.c
index 70872e8011c..4455718aac3 100644
--- a/server/object.c
+++ b/server/object.c
@@ -583,15 +583,18 @@ int set_sd_defaults_from_token( struct object *obj, const struct security_descri
     }
     else new_sd.group_len = 0;
 
-    new_sd.control |= SE_SACL_PRESENT;
     sacl = sd_get_sacl( sd, &present );
     if (set_info & SACL_SECURITY_INFORMATION && present)
+    {
+        new_sd.control |= SE_SACL_PRESENT;
         new_sd.sacl_len = sd->sacl_len;
+    }
     else if (set_info & LABEL_SECURITY_INFORMATION && present)
     {
         const ACL *old_sacl = NULL;
         if (obj->sd && obj->sd->control & SE_SACL_PRESENT) old_sacl = sd_get_sacl( obj->sd, &present );
         if (!(replaced_sacl = replace_security_labels( old_sacl, sacl ))) return 0;
+        new_sd.control |= SE_SACL_PRESENT;
         new_sd.sacl_len = replaced_sacl->AclSize;
         sacl = replaced_sacl;
     }
@@ -600,24 +603,33 @@ int set_sd_defaults_from_token( struct object *obj, const struct security_descri
         if (obj->sd) sacl = sd_get_sacl( obj->sd, &present );
 
         if (obj->sd && present)
+        {
+            new_sd.control |= SE_SACL_PRESENT;
             new_sd.sacl_len = obj->sd->sacl_len;
+        }
         else
             new_sd.sacl_len = 0;
     }
 
-    new_sd.control |= SE_DACL_PRESENT;
     dacl = sd_get_dacl( sd, &present );
     if (set_info & DACL_SECURITY_INFORMATION && present)
+    {
+        new_sd.control |= SE_DACL_PRESENT;
         new_sd.dacl_len = sd->dacl_len;
+    }
     else
     {
         if (obj->sd) dacl = sd_get_dacl( obj->sd, &present );
 
         if (obj->sd && present)
+        {
+            new_sd.control |= SE_DACL_PRESENT;
             new_sd.dacl_len = obj->sd->dacl_len;
+        }
         else if (token)
         {
             dacl = token_get_default_dacl( token );
+            new_sd.control |= SE_DACL_PRESENT;
             new_sd.dacl_len = dacl->AclSize;
         }
         else new_sd.dacl_len = 0;
-- 
GitLab