Re: SFTP ACLs need inheritance support

[denis bider <ietf-ssh%denisbider.com@localhost>]

> Hmmm... I was thinking of these as simply enabling the
> backup or restore privilege which bypasses access
> checks-- which would be highly useful for things like
> scanning the volume to see who is using what space--

Based on my reading in the past few days (but not actual first-hand experience), it seems that Windows always requires not just a privilege but also a flag; i.e. the "SeSecurityPrivilege" goes hand in hand with ACCESS_SYSTEM_SECURITY flag (one is not useful without the other), and the "SeBackupPrivilege" goes hand in hand with the FILE_FLAG_BACKUP_SEMANTICS flag.

In other words, it is my understanding that you have to specify FILE_FLAG_BACKUP_SEMANTICS in order to get any kind of special behavior from Windows, and FILE_FLAG_BACKUP_SEMANTICS in turn means that you'll be reading from the backup stream, and you can't have one without the other.

My understanding may be incorrect.