JCR_MODIFY_ACCESS_CONTROL privilege inheritance

[jacobilsoe]

Hi.

I have a few questions about ACLs in ModeShape.

Suppose you have a node called Parent with all privileges.

Now create a child node (Child1) of the Parent node and give it an empty list of ACLs.

Change the Parent node to no longer have the JCR_MODIFY_ACCESS_CONTROL privilege.

Create another child node (Child2) of the Parent node.

In this case it is not possible to assign ACLs (not even the empty list) to Child2 since the Parent does not have the JCR_MODIFY_ACCESS_CONTROL privilege.

I can still assign ACLs to Child1, though, since it was created when Parent had JCR_MODIFY_ACCESS_CONTROL.

Is this expected behaviour? Should it not be possible to assign ACLs to a Child even though the parent does not have JCR_MODIFY_ACCESS_CONTROL?

I mean, it is possible to create the child so why should it not be possible to assign ACLs to it?

Thanks in advance,

Jacob

[hchiorean]

I think the reason you can still assign ACLs to Child1 is because it has an "empty" ACL list. The expected behavior should be that if Child1 has an empty ACL, Child2 doesn't have any ACLs at all and the parent doesn't have the JCR_MODIFY_ACCESS_CONTROL privilege, it shouldn't be possible to assign any privileges to either of the children.

This is bug IMO, so please open a JIRA for it. Thanks.

[jacobilsoe]

Thanks, I have open a bug for it: https://issues.jboss.org/browse/MODE-2408