Duplicate permissions getting added to folders copied from server!

Actually it doesn't even need to to be copied to/from the server, just try duplicating with Finder on the server! I've filed a big too since I was getting really nervous that 10.6.7 might not fix this, so I just filed mine #9160099 (an earlier poster referenced his bug #8816661, that 343,438 bug reports later!)

I got it down to the bare minumum on a clean OS X Server install, not AD bound or anything extraneous. Just AFP running on a server with an IP with forward reverse lookup. I made a share, added admin (501) to the ACL (as Read only), touched a file and duplicated it in Finder, locally on the server.

10.6-10.6.2 functioned fine. 10.6.3 and 10.6.4 added bizarre behavior where a WRITE ACE was added to the ACL, but the ACEs weren't "stacking up", 10.6.5 and 10.6.6 added the redundant ACEs that when you tried copying/duplicating packages and apps with Finder would result in insane amounts of duplication, try Chess.app you'll get 18 ACEs deep in one Finder copy!

So get reporting folks, 10.6.7 might be the last Snow Leopard update, and even if it isn't I'm getting pretty tired of dealing with this bug and don't want to wait until 10.6.8!

I've just verified that 10.6.7 does not contain a fix for this problem. The only real fix at this point appears to be backing down to 10.6.4.

Writing shell scrips to remove then add back accurate ACLs appears to help lessen the issue. And will be necessary once there is a fix as all those duplicated ACLs will likely remain.

In an environment with hundreds of macs and dozens of servers this is really hard to deal with.

Well I wasn't going to be able to test this till tomorrow. Sad to see that it doesn't fix the problem.

This won't help too much since this is a bug that needs fixing, but I did an extensive write up on what causes it:
http://www.brunerd.com/blog/2011/03/22/finders-nasty-inherited-acl-bug-aka-error -41/

What will help is to recreate it in your environment and file a bug report with Apple! 🙂
http://bugreporter.apple.com

I thought I'd share this with everyone. It's a small ruby script I threw together in the past few days to help with removing duplicate permissions:
https://gist.github.com/882414

But I should give a disclaimer that it prunes identical ACEs starting from the end of the list, so it may have a side effect of upsetting anything that relies on a specific ordering of ACEs. I'm not quite sure how to solve that potential bug.

If you have any improvements or fixes, feel free to fork it.

Message was edited by: Kree the Basilisk

I too am having this problem. We use Active Directory integration since Apple is discontinuing xserv's and we will be switching to a different solution at least for the servers in the future. The problem is apparent locally regardless of network copying. I thought the problem was related to the workstations and server's being integrated into Active Directory, but such is not the case from the looks of it. I have not found a fix for the problem either, except to have the users propagate the permissions on their "data" drive on their local machine before copying to the file server, which pretty much cleans everything up. Then every few weeks propagate the permissions on the shares. We have a pretty simplistic setup, and we are experiencing this problem first hand on multiple machines. I will also be filing a bug report with Apple on the problem as well.

I filed a bug report as well. 9230007 I sent them a video screenshot of the problem in action. I will let everyone know if I get a response.

I'd be curious to know if they merge it with an existing, or what...
I haven't heard back from them for my bug submitted March 20th.

I also wonder if they will merge the issue. We have Apple enterprise support, I contacted them regarding the problem. The tech I was working with was able to duplicate the problem. He told me that the engineering team is aware of the issue, and to look for a fix.

Hello Joshua,

This is a follow up to Bug ID# 9230007. After further investigation it has been determined that this is a known issue, which is currently being investigated by engineering. This issue has been filed in our bug database under the original Bug ID# 9199081. The original bug number being used to track this duplicate issue can be found in the State column, in this format: Duplicate/OrigBug#.

Thank you for submitting this bug report. We truly appreciate your assistance in helping us discover and isolate bugs.

Best Regards,

Developer Support
Apple Worldwide Developer Relations




So..... Anyone else hoping for an improved/new finder in 10.6.8?

Huh...
Mine was just merged with Bug ID# 8729952
Go fig.

Security Update 2011-002 does not resolve the issue.

Nope it doesn't... because it addresses Security not functionality 🙂
http://support.apple.com/kb/HT4608

I figured the first response would be to let me know it was a security update, but then I thought, you know, ACLs have quite a bit to do with security.

True, true (ACLs and security)... this bug it falls under the heading "There is such a thing as *too much* security"! Ha ha. I don't expect a fix for this in anything but a Mac OS X 10.6.8 update