From 4c33a58449e3a3dd82071d6f2efb8a9dcd80d512 Mon Sep 17 00:00:00 2001
From: Art Yerkes <art.yerkes@gmail.com>
Date: Sun, 9 Sep 2007 12:21:22 +0000
Subject: [PATCH] Mask values that control inheritability of the handle, and
 don't affect access.

svn path=/trunk/; revision=28973
---
 reactos/ntoskrnl/se/semgr.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/reactos/ntoskrnl/se/semgr.c b/reactos/ntoskrnl/se/semgr.c
index 1b2017f0cbe..05a28647d02 100644
--- a/reactos/ntoskrnl/se/semgr.c
+++ b/reactos/ntoskrnl/se/semgr.c
@@ -1035,7 +1035,8 @@ SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
                         AccessMode))
     {
       CurrentAccess |= WRITE_OWNER;
-      if (DesiredAccess == CurrentAccess)
+      if ((DesiredAccess & ~VALID_INHERIT_FLAGS) == 
+          (CurrentAccess & ~VALID_INHERIT_FLAGS))
         {
           if (SubjectContextLocked == FALSE)
             {
@@ -1067,7 +1068,8 @@ SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
   if (Sid && SepSidInToken(Token, Sid))
     {
       CurrentAccess |= (READ_CONTROL | WRITE_DAC);
-      if (DesiredAccess == CurrentAccess)
+      if ((DesiredAccess & ~VALID_INHERIT_FLAGS) == 
+          (CurrentAccess & ~VALID_INHERIT_FLAGS))
         {
           if (SubjectContextLocked == FALSE)
             {
@@ -1145,7 +1147,8 @@ SeAccessCheck(IN PSECURITY_DESCRIPTOR SecurityDescriptor,
       *AccessStatus = STATUS_SUCCESS;
       return TRUE;
     }
-  else if (*GrantedAccess == DesiredAccess)
+  else if ((*GrantedAccess & ~VALID_INHERIT_FLAGS) == 
+           (DesiredAccess & ~VALID_INHERIT_FLAGS))
     {
       *AccessStatus = STATUS_SUCCESS;
       return TRUE;