starting to sync for 3.0beta2

10 files changed, 545 insertions, 608 deletions

diff --git a/source/smbd/build_options.c b/source/smbd/build_options.c
deleted file mode 100644
index 43335666a63..00000000000
--- a/source/smbd/build_options.c
+++ /dev/null
@@ -1,532 +0,0 @@
-/* 
-   Unix SMB/CIFS implementation.
-   Build Options for Samba Suite
-   Copyright (C) Vance Lankhaar <vlankhaar@hotmail.com> 2001
-   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001
-   
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
-   (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-   
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "includes.h"
-#include "build_env.h"
-#include "dynconfig.h"
-
-static void output(BOOL screen, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
-
-/*
-#define OUTPUT(x) snprintf(outstring,sizeof(outstring),x); output(screen,outstring);
-*/
-/****************************************************************************
-helper function for build_options
-****************************************************************************/
-static void output(BOOL screen, const char *format, ...)
-{
-       char *ptr;
-       va_list ap;
-       
-       va_start(ap, format);
-       vasprintf(&ptr,format,ap);
-       va_end(ap);
-
-       if (screen) {
-              d_printf("%s", ptr);
-       } else {
-	       DEBUG(4,("%s", ptr));
-       }
-       
-       SAFE_FREE(ptr);
-}
-
-/****************************************************************************
-options set at build time for the samba suite
-****************************************************************************/
-void build_options(BOOL screen)
-{
-       if ((DEBUGLEVEL < 4) && (!screen)) {
-	       return;
-       }
-
-#ifdef _BUILD_ENV_H
-       /* Output information about the build environment */
-       output(screen,"Build environment:\n");
-       output(screen,"   Built by:    %s@%s\n",BUILD_ENV_USER,BUILD_ENV_HOST);
-       output(screen,"   Built on:    %s\n",BUILD_ENV_DATE);
-
-       output(screen,"   Built using: %s\n",BUILD_ENV_COMPILER);
-       output(screen,"   Build host:  %s\n",BUILD_ENV_UNAME);
-       output(screen,"   SRCDIR:      %s\n",BUILD_ENV_SRCDIR);
-       output(screen,"   BUILDDIR:    %s\n",BUILD_ENV_BUILDDIR);
-
-       
-#endif
-
-       /* Output various options (most correspond to --with options) */ 
-       output(screen,"\nBuild options:\n");
-#ifdef WITH_SMBWRAPPER 
-       output(screen,"   WITH_SMBWRAPPER\n");
-#endif
-#ifdef WITH_AFS
-       output(screen,"   WITH_AFS\n");
-#endif
-#ifdef WITH_DFS
-       output(screen,"   WITH_DFS\n");
-#endif
-#ifdef KRB4_AUTH
-       output(screen,"   KRB4_AUTH");
-#endif
-#ifdef HAVE_KRB5
-       output(screen,"   HAVE_KRB5");
-#endif
-#ifdef HAVE_GSSAPI
-       output(screen,"   HAVE_GSSAPI");
-#endif
-#ifdef HAVE_LDAP
-       output(screen,"   HAVE_LDAP");
-#endif
-#ifdef WITH_AUTOMOUNT
-       output(screen,"   WITH_AUTOMOUNT\n");
-#endif
-#ifdef WITH_SMBMOUNT
-       output(screen,"   WITH_SMBMOUNT\n");
-#endif
-#ifdef WITH_PAM
-       output(screen,"   WITH_PAM\n");
-#endif
-#ifdef WITH_NISPLUS_HOME
-       output(screen,"   WITH_NISPLUS_HOME\n");
-#endif
-#ifdef WITH_SYSLOG
-       output(screen,"   WITH_SYSLOG\n");
-#endif
-#ifdef WITH_PROFILE
-       output(screen,"   WITH_PROFILE\n");
-#endif
-#ifdef WITH_QUOTAS
-       output(screen,"   WITH_QUOTAS\n");
-#endif
-#ifdef WITH_VFS
-       output(screen,"   WITH_VFS\n");
-#endif
-#ifdef USE_SPINLOCKS
-       output(screen,"   USE_SPINLOCKS\n");
-#endif
-#ifdef SPARC_SPINLOCKS
-       output(screen,"   SPARC_SPINLOCKS\n");
-#endif
-#ifdef INTEL_SPINLOCKS
-       output(screen,"   INTEL_SPINLOCKS\n");
-#endif
-#ifdef MIPS_SPINLOCKS
-       output(screen,"   MIPS_SPINLOCKS\n");
-#endif
-#ifdef POWERPC_SPINLOCKS
-       output(screen,"   POWERPC_SPINLOCKS\n");
-#endif
-#ifdef HAVE_UNIXWARE_ACLS
-       output(screen,"   HAVE_UNIXWARE_ACLS\n");
-#endif
-#ifdef HAVE_SOLARIS_ACLS
-       output(screen,"   HAVE_SOLARIS_ACLS\n");
-#endif 
-#ifdef HAVE_IRIX_ACLS
-       output(screen,"   HAVE_IRIX_ACLS\n");
-#endif
-#ifdef HAVE_AIX_ACLS
-       output(screen,"   HAVE_AIX_ACLS\n");
-#endif
-#ifdef HAVE_POSIX_ACLS
-       output(screen,"   HAVE_POSIX_ACLS\n");
-#endif
-#ifdef HAVE_TRU64_ACLS
-       output(screen,"   HAVE_TRU64_ACLS\n");
-#endif
-
-#ifdef HAVE_ACL_GET_PERM_NP
-       output(screen,"   HAVE_ACL_GET_PERM_NP\n");
-#endif
-#ifdef HAVE_NO_ACLS
-       output(screen,"   HAVE_NO_ACLS\n");
-#endif
-#ifdef HAVE_LIBREADLINE
-       output(screen,"   HAVE_LIBREADLINE\n"); 
-#endif
-#ifdef WITH_LIBICONV
-       output(screen,"   WITH_LIBICONV: %s\n",WITH_LIBICONV);
-#endif
-
-
-       /* Output various paths to files and directories */
-       output(screen,"\nPaths:\n");
-       output(screen,"   CONFIGFILE: %s\n", dyn_CONFIGFILE);
-#ifdef PRIVATE_DIR
-       output(screen,"   PRIVATE_DIR: %s\n",PRIVATE_DIR);
-#endif
-#ifdef LMHOSTSFILE
-       output(screen,"   LMHOSTSFILE: %s\n",LMHOSTSFILE);
-#endif
-       output(screen,"   SBINDIR: %s\n", dyn_SBINDIR);
-       output(screen,"   BINDIR: %s\n", dyn_BINDIR);
-       output(screen,"   LOCKDIR: %s\n",dyn_LOCKDIR);
-       output(screen,"   LOGFILEBASE: %s\n", dyn_LOGFILEBASE);
-
-       /*Output various other options (most map to defines in the configure script*/
-       output(screen,"\nOther Build Options:\n");
-#ifdef HAVE_VOLATILE
-       output(screen,"   HAVE_VOLATILE\n");
-#endif
-#ifdef HAVE_SHADOW_H
-       output(screen,"   HAVE_SHADOW_H\n");
-#endif
-#ifdef HAVE_CRYPT
-       output(screen,"   HAVE_CRYPT\n");
-#endif
-#ifdef USE_BOTH_CRYPT_CALLS
-       output(screen,"   USE_BOTH_CRYPT_CALLS\n");
-#endif
-#ifdef HAVE_TRUNCATED_SALT
-       output(screen,"   HAVE_TRUNCATED_SALT\n");
-#endif
-#ifdef HAVE_CUPS
-       output(screen,"   HAVE_CUPS\n");
-#endif
-#ifdef HAVE_CUPS_CUPS_H
-       output(screen,"   HAVE_CUPS_CUPS_H\n");
-#endif
-#ifdef HAVE_CUPS_LANGUAGE_H
-       output(screen,"   HAVE_CUPS_LANGUAGE_H\n");
-#endif
-#ifdef HAVE_DLOPEN
-       output(screen,"   HAVE_DLOPEN\n");
-#endif
-#ifdef HAVE_DLCLOSE
-       output(screen,"   HAVE_DLCLOSE\n");
-#endif
-#ifdef HAVE_DLSYM
-       output(screen,"   HAVE_DLSYM\n");
-#endif
-#ifdef HAVE_DLERROR
-       output(screen,"   HAVE_DLERROR\n");
-#endif
-#ifdef HAVE_UNIXSOCKET
-       output(screen,"   HAVE_UNIXSOCKET\n");
-#endif
-#ifdef HAVE_SOCKLEN_T_TYPE
-       output(screen,"   HAVE_SOCKLEN_T_TYPE\n");
-#endif
-#ifdef HAVE_SIG_ATOMIC_T_TYPE
-       output(screen,"   HAVE_SIG_ATOMIC_T_TYPE\n");
-#endif
-#ifdef HAVE_SETRESUID
-       output(screen,"   HAVE_SETRESUID\n");
-#endif
-#ifdef HAVE_SETRESGID
-       output(screen,"   HAVE_SETRESGID\n");
-#endif
-#ifdef HAVE_CONNECT
-       output(screen,"   HAVE_CONNECT\n");
-#endif
-#ifdef HAVE_YP_GET_DEFAULT_DOMAIN
-       output(screen,"   HAVE_YP_GET_DEFAULT_DOMAIN\n");
-#endif
-#ifdef HAVE_STAT64
-       output(screen,"   HAVE_STAT64\n");
-#endif
-#ifdef HAVE_LSTAT64
-       output(screen,"   HAVE_LSTAT64\n");
-#endif
-#ifdef HAVE_FSTAT64
-       output(screen,"   HAVE_FSTAT64\n");
-#endif
-#ifdef HAVE_STRCASECMP
-       output(screen,"   HAVE_STRCASECMP\n");
-#endif
-#ifdef HAVE_MEMSET
-       output(screen,"   HAVE_MEMSET\n");
-#endif
-#ifdef HAVE_LONGLONG
-       output(screen,"   HAVE_LONGLONG\n");
-#endif
-#ifdef COMPILER_SUPPORTS_LL
-       output(screen,"   COMPILER_SUPPORTS_LL\n");
-#endif
-#ifdef SIZEOF_OFF_T
-       output(screen,"   SIZEOF_OFF_T: %d\n",SIZEOF_OFF_T);
-#endif
-#ifdef HAVE_OFF64_T
-       output(screen,"   HAVE_OFF64_T\n");
-#endif
-#ifdef SIZEOF_INO_T
-       output(screen,"   SIZEOF_INO_T: %d\n",SIZEOF_INO_T);
-#endif
-#ifdef HAVE_INO64_T
-       output(screen,"   HAVE_INO64_T\n");
-#endif
-#ifdef HAVE_STRUCT_DIRENT64
-       output(screen,"   HAVE_STRUCT_DIRENT64\n");
-#endif
-#ifdef HAVE_UNSIGNED_CHAR
-       output(screen,"   HAVE_UNSIGNED_CHAR\n");
-#endif
-#ifdef HAVE_SOCK_SIN_LEN
-       output(screen,"   HAVE_SOCK_SIN_LEN\n");
-#endif
-#ifdef SEEKDIR_RETURNS_VOID
-       output(screen,"   SEEKDIR_RETURNS_VOID\n");
-#endif
-#ifdef HAVE_FUNCTION_MACRO
-       output(screen,"   HAVE_FUNCTION_MACRO\n");
-#endif
-#ifdef HAVE_GETTIMEOFDAY
-       output(screen,"   HAVE_GETTIMEOFDAY\n");
-#endif
-#ifdef HAVE_C99_VSNPRINTF
-       output(screen,"   HAVE_C99_VSNPRINTF\n");
-#endif
-#ifdef HAVE_BROKEN_READDIR
-       output(screen,"   HAVE_BROKEN_READDIR\n");
-#endif
-#ifdef HAVE_NATIVE_ICONV
-       output(screen,"   HAVE_NATIVE_ICONV\n");
-#endif
-#ifdef HAVE_KERNEL_OPLOCKS_LINUX
-       output(screen,"   HAVE_KERNEL_OPLOCKS_LINUX\n");
-#endif
-#ifdef HAVE_KERNEL_CHANGE_NOTIFY
-       output(screen,"   HAVE_KERNEL_CHANGE_NOTIFY\n");
-#endif
-#ifdef HAVE_KERNEL_SHARE_MODES
-       output(screen,"   HAVE_KERNEL_SHARE_MODES\n");
-#endif
-#ifdef HAVE_KERNEL_OPLOCKS_IRIX
-       output(screen,"   HAVE_KERNEL_OPLOCKS_IRIX\n");
-#endif
-#ifdef HAVE_IRIX_SPECIFIC_CAPABILITIES
-       output(screen,"   HAVE_IRIX_SPECIFIC_CAPABILITIES\n");
-#endif
-#ifdef HAVE_INT16_FROM_RPC_RPC_H
-       output(screen,"   HAVE_INT16_FROM_RPC_RPC_H\n");
-#endif
-#ifdef HAVE_UINT16_FROM_RPC_RPC_H
-       output(screen,"   HAVE_UINT16_FROM_RPC_RPC_H\n");
-#endif
-#ifdef HAVE_INT32_FROM_RPC_RPC_H
-       output(screen,"   HAVE_INT16_FROM_RPC_RPC_H\n");
-#endif
-#ifdef HAVE_UINT32_FROM_RPC_RPC_H
-       output(screen,"   HAVE_UINT32_FROM_RPC_RPC_H\n");
-#endif
-#ifdef HAVE_RPC_AUTH_ERROR_CONFLICT
-       output(screen,"   HAVE_RPC_AUTH_ERROR_CONFLICT\n");
-#endif
-#ifdef HAVE_FTRUNCATE_EXTEND
-       output(screen,"   HAVE_FTRUNCATE_EXTEND\n");
-#endif
-#ifdef HAVE_WORKING_AF_LOCAL
-       output(screen,"   HAVE_WORKING_AF_LOCAL\n");
-#endif
-#ifdef HAVE_BROKEN_GETGROUPS
-       output(screen,"   HAVE_BROKEN_GETGROUPS\n");
-#endif
-#ifdef REPLACE_GETPASS
-       output(screen,"   REPLACE_GETPASS\n");
-#endif
-#ifdef REPLACE_INET_NTOA
-       output(screen,"   REPLACE_INET_NTOA\n");
-#endif
-#ifdef HAVE_SECURE_MKSTEMP
-       output(screen,"   HAVE_SECURE_MKSTEMP\n");
-#endif
-#ifdef SYSCONF_SC_NGROUPS_MAX
-       output(screen,"   SYSCONF_SC_NGROUPS_MAX\n");
-#endif
-#ifdef HAVE_IFACE_AIX
-       output(screen,"   HAVE_IFACE_AIX\n");
-#endif
-#ifdef HAVE_IFACE_IFCONF
-       output(screen,"   HAVE_IFACE_IFCONF\n");
-#endif
-#ifdef HAVE_IFACE_IFREQ
-       output(screen,"   HAVE_IFACE_IFREQ\n");
-#endif
-#ifdef USE_SETRESUID
-       output(screen,"   USE_SETRESUID\n");
-#endif
-#ifdef USE_SETRESGID
-       output(screen,"   USE_SETREUID\n");
-#endif
-#ifdef USE_SETEUID
-       output(screen,"   USE_SETEUID\n");
-#endif
-#ifdef USE_SETUIDX
-       output(screen,"   USE_SETUIDX\n");
-#endif
-#ifdef HAVE_MMAP
-       output(screen,"   HAVE_MMAP\n");
-#endif
-#ifdef MMAP_BLACKLIST
-       output(screen,"   MMAP_BLACKLIST\n");
-#endif
-#ifdef FTRUNCATE_NEEDS_ROOT
-       output(screen,"   FTRUNCATE_NEEDS_ROOT\n");
-#endif
-#ifdef HAVE_FCNTL_LOCK
-       output(screen,"   HAVE_FCNTL_LOCK\n");
-#endif
-#ifdef HAVE_BROKEN_FCNTL64_LOCKS
-       output(screen,"   HAVE_BROKEN_FCNTL64_LOCKS\n");
-#endif
-#ifdef HAVE_STRUCT_FLOCK64
-       output(screen,"   HAVE_STRUCT_FLOCK64\n");
-#endif
-#ifdef BROKEN_NISPLUS_INCLUDE_FILES
-       output(screen,"   BROKEN_NISPLUS_INCLUDE_FILES\n");
-#endif
-#ifdef HAVE_LIBPAM
-       output(screen,"   HAVE_LIBPAM\n");
-#endif
-#ifdef STAT_STATVFS64
-       output(screen,"   STAT_STATVFS64\n");
-#endif
-#ifdef STAT_STATVFS
-       output(screen,"   STAT_STATVFS\n");
-#endif
-#ifdef STAT_STATFS3_OSF1
-       output(screen,"   STAT_STATFS3_OSF1\n");
-#endif
-#ifdef STAT_STATFS2_BSIZE
-       output(screen,"   STAT_STATFS2_BSIZE\n");
-#endif
-#ifdef STAT_STATFS4
-       output(screen,"   STAT_STATFS4\n");
-#endif
-#ifdef STAT_STATFS2_FSIZE
-       output(screen,"   STAT_STATFS2_FSIZE\n");
-#endif
-#ifdef STAT_STATFS2_FS_DATA
-       output(screen,"   STAT_STATFS2_FS_DATA\n");
-#endif
-#ifdef HAVE_EXPLICIT_LARGEFILE_SUPPORT
-       output(screen,"   HAVE_EXPLICIT_LARGEFILE_SUPPORT\n");
-#endif
-
-#ifdef WITH_UTMP
-       /* Output UTMP Stuff */
-       output(screen,"\nUTMP Related:\n");
-       output(screen,"   WITH_UTMP\n");
-
-#ifdef HAVE_UTIMBUF
-       output(screen,"   HAVE_UTIMBUF\n");
-#endif
-#ifdef HAVE_UT_UT_NAME
-       output(screen,"   HAVE_UT_UT_NAME\n");
-#endif
-#ifdef HAVE_UT_UT_USER
-       output(screen,"   HAVE_UT_UT_USER\n");
-#endif
-#ifdef HAVE_UT_UT_ID
-       output(screen,"   HAVE_UT_UT_ID\n");
-#endif
-#ifdef HAVE_UT_UT_HOST
-       output(screen,"   HAVE_UT_UT_HOST\n");
-#endif
-#ifdef HAVE_UT_UT_TIME
-       output(screen,"   HAVE_UT_UT_TIME\n");
-#endif
-#ifdef HAVE_UT_UT_TV
-       output(screen,"   HAVE_UT_UT_TV\n");
-#endif
-#ifdef HAVE_UT_UT_TYPE
-       output(screen,"   HAVE_UT_UT_TYPE\n");
-#endif
-#ifdef HAVE_UT_UT_PID
-       output(screen,"   HAVE_UT_UT_PID\n");
-#endif
-#ifdef HAVE_UT_UT_EXIT
-       output(screen,"   HAVE_UT_UT_EXIT\n");
-#endif
-#ifdef HAVE_UT_UT_ADDR
-       output(screen,"   HAVE_UT_UT_ADDR\n");
-#endif
-#ifdef PUTUTLINE_RETURNS_UTMP
-       output(screen,"   PUTUTLINE_RETURNS_UTMP\n");
-#endif
-#ifdef HAVE_UX_UT_SYSLEN
-       output(screen,"   HAVE_UX_UT_SYSLEN\n");
-#endif
-#endif /* WITH_UTMP */
-
-       /* Output Build OS */
-       output(screen,"\nBuilt for host os:\n");
-#ifdef LINUX
-       output(screen,"   LINUX\n");
-#endif
-#ifdef SUNOS5
-       output(screen,"   SUNOS5\n");
-#endif
-#ifdef SUNOS4
-       output(screen,"   SUNOS4\n");
-#endif
-       /* BSD Isn't Defined in the configure script, but there is something about it in include/config.h.in (and I guess acconfig.h) */
-#ifdef BSD
-       output(screen,"   BSD\n");
-#endif
-#ifdef IRIX
-       output(screen,"   IRIX\n");
-#endif
-#ifdef IRIX6
-       output(screen,"   IRIX6\n");
-#endif
-#ifdef AIX
-       output(screen,"   AIX\n");
-#endif
-#ifdef HPUX
-       output(screen,"   HPUX\n");
-#endif
-#ifdef QNX
-       output(screen,"   QNX\n");
-#endif
-#ifdef OSF1
-       output(screen,"   OSF1\n");
-#endif
-#ifdef SCO
-       output(screen,"   SCO\n");
-#endif
-#ifdef UNIXWARE
-       output(screen,"   UNIXWARE\n");
-#endif
-#ifdef NEXT2
-       output(screen,"   NEXT2\n");
-#endif
-#ifdef RELIANTUNIX
-       output(screen,"   RELIANTUNIX\n");
-#endif
-
-       /* Output the sizes of the various types */
-       output(screen,"\nType sizes:\n");
-       output(screen,"   sizeof(char):    %d\n",sizeof(char));
-       output(screen,"   sizeof(int):     %d\n",sizeof(int));
-       output(screen,"   sizeof(long):    %d\n",sizeof(long));
-       output(screen,"   sizeof(uint8):   %d\n",sizeof(uint8));
-       output(screen,"   sizeof(uint16):  %d\n",sizeof(uint16));
-       output(screen,"   sizeof(uint32):  %d\n",sizeof(uint32));
-       output(screen,"   sizeof(short):   %d\n",sizeof(short));
-       output(screen,"   sizeof(void*):   %d\n",sizeof(void*));
-
-	   output(screen,"\nBuiltin modules:\n");
-	   output(screen,"%s\n", STRING_STATIC_MODULES);
-}
-
-
-
diff --git a/source/smbd/change_trust_pw.c b/source/smbd/change_trust_pw.c
index 8aff96d0d6d..4993e285cac 100644
--- a/source/smbd/change_trust_pw.c
+++ b/source/smbd/change_trust_pw.c
@@ -43,7 +43,7 @@ NTSTATUS change_trust_account_password( const char *domain, const char *remote_m
 			goto failed;
 		}
 
-		if ( !lookup_dc_name(global_myname(), domain, &pdc_ip, dc_name) ) 
+		if ( !name_status_find( domain, 0x1b, 0x20, pdc_ip, dc_name) )
 			goto failed;
 	}
 	/* supoport old deprecated "smbpasswd -j DOMAIN -r MACHINE" behavior */
diff --git a/source/smbd/lanman.c b/source/smbd/lanman.c
index 98857c6d320..6976a066846 100644
--- a/source/smbd/lanman.c
+++ b/source/smbd/lanman.c
@@ -1649,7 +1649,7 @@ static BOOL api_RNetGroupEnum(connection_struct *conn,uint16 vuid, char *param,c
 		return False;
 
 	/* get list of domain groups SID_DOMAIN_GRP=2 */
-	if(!pdb_enum_group_mapping(SID_NAME_DOM_GRP , &group_list, &num_entries, False, False)) {
+	if(!pdb_enum_group_mapping(SID_NAME_DOM_GRP , &group_list, &num_entries, False)) {
 		DEBUG(3,("api_RNetGroupEnum:failed to get group list"));
 		return False;
 	}
diff --git a/source/smbd/mangle_hash.c b/source/smbd/mangle_hash.c
index d2eb996899c..d4cf369f287 100644
--- a/source/smbd/mangle_hash.c
+++ b/source/smbd/mangle_hash.c
@@ -217,7 +217,7 @@ static NTSTATUS is_valid_name(const smb_ucs2_t *fname, BOOL allow_wildcards)
 		return NT_STATUS_UNSUCCESSFUL;
 	
 	ret = has_valid_chars(fname, allow_wildcards);
-	if (NT_STATUS_IS_ERR(ret))
+	if (!NT_STATUS_IS_OK(ret))
 		return ret;
 
 	str = strdup_w(fname);
@@ -285,10 +285,10 @@ static NTSTATUS is_8_3_w(const smb_ucs2_t *fname, BOOL allow_wildcards)
 	if (strcmp_wa(fname, ".") == 0 || strcmp_wa(fname, "..") == 0)
 		return NT_STATUS_OK;
 
-	if (NT_STATUS_IS_ERR(is_valid_name(fname, allow_wildcards)))
+	if (!NT_STATUS_IS_OK(is_valid_name(fname, allow_wildcards)))
 		goto done;
 
-	if (NT_STATUS_IS_ERR(mangle_get_prefix(fname, &pref, &ext, allow_wildcards)))
+	if (!NT_STATUS_IS_OK(mangle_get_prefix(fname, &pref, &ext, allow_wildcards)))
 		goto done;
 	plen = strlen_w(pref);
 
@@ -735,7 +735,7 @@ static void name_map(char *OutName, BOOL need83, BOOL cache83)
 		return;
 	}
 
-	if( !need83 && NT_STATUS_IS_ERR(is_valid_name(OutName_ucs2, False)))
+	if( !need83 && !NT_STATUS_IS_OK(is_valid_name(OutName_ucs2, False)))
 		need83 = True;
 
 	/* check if it's already in 8.3 format */
diff --git a/source/smbd/ntquotas.c b/source/smbd/ntquotas.c
index 6a217a32587..2e865000ecc 100644
--- a/source/smbd/ntquotas.c
+++ b/source/smbd/ntquotas.c
@@ -84,7 +84,7 @@ int vfs_get_ntquota(files_struct *fsp, enum SMB_QUOTA_TYPE qtype, DOM_SID *psid,
 
 	id.uid = -1;
 
-	if (psid && NT_STATUS_IS_ERR(sid_to_uid(psid, &id.uid))) {
+	if (psid && !NT_STATUS_IS_OK(sid_to_uid(psid, &id.uid))) {
 		DEBUG(0,("sid_to_uid: failed, SID[%s]\n",
 			sid_string_static(psid)));	
 	}
@@ -128,7 +128,7 @@ int vfs_set_ntquota(files_struct *fsp, enum SMB_QUOTA_TYPE qtype, DOM_SID *psid,
 	D.isoftlimit = limit_blk2inodes(D.softlimit);
 	D.ihardlimit = limit_blk2inodes(D.hardlimit);
 
-	if (psid && NT_STATUS_IS_ERR(sid_to_uid(psid, &id.uid))) {
+	if (psid && !NT_STATUS_IS_OK(sid_to_uid(psid, &id.uid))) {
 		DEBUG(0,("sid_to_uid: failed, SID[%s]\n",
 			sid_string_static(psid)));	
 	}
@@ -182,7 +182,7 @@ int vfs_get_user_ntquota_list(files_struct *fsp, SMB_NTQUOTA_LIST **qt_list)
 			continue;
 		}
 
-		if (NT_STATUS_IS_ERR(uid_to_sid(&sid, usr->pw_uid))) {
+		if (!NT_STATUS_IS_OK(uid_to_sid(&sid, usr->pw_uid))) {
 			DEBUG(0,("uid_to_sid failed for %ld\n",(long)usr->pw_uid));
 			continue;
 		}
diff --git a/source/smbd/nttrans.c b/source/smbd/nttrans.c
index fa7b78ecc26..13692d3c2c2 100644
--- a/source/smbd/nttrans.c
+++ b/source/smbd/nttrans.c
@@ -1753,7 +1753,7 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou
 		   but works ok like this --metze
 		 */
 
-		DEBUG(1,("FSCTL_GET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control));
+		DEBUG(10,("FSCTL_GET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control));
 		send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_OK, NULL, 0, NULL, 0);
 		return -1;
 
@@ -1762,7 +1762,7 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou
 		 * --metze
 		 */
 
-		DEBUG(1,("FSCTL_GET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control));
+		DEBUG(10,("FSCTL_GET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control));
 		send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
 		return -1;
 
@@ -1771,7 +1771,7 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou
 		 * --metze
 		 */
 
-		DEBUG(1,("FSCTL_SET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control));
+		DEBUG(10,("FSCTL_SET_REPARSE_POINT: fnum=%d control=0x%08x\n",fnum,control));
 		send_nt_replies(inbuf, outbuf, bufsize, NT_STATUS_NOT_A_REPARSE_POINT, NULL, 0, NULL, 0);
 		return -1;
 			
@@ -1788,16 +1788,16 @@ static int call_nt_transact_ioctl(connection_struct *conn, char *inbuf, char *ou
 		uid_t uid;
 		size_t sid_len=SID_MAX_SIZE;
 		
-		DEBUG(1,("FSCTL_FIND_FILES_BY_SID: fnum=%d control=0x%08x\n",fnum,control));
+		DEBUG(10,("FSCTL_FIND_FILES_BY_SID: fnum=%d control=0x%08x\n",fnum,control));
 		
 		/* this is not the length of the sid :-( so unknown 4 bytes */
 		/*sid_len = IVAL(pdata,0);	
 		DEBUGADD(0,("sid_len: (%u)\n",sid_len));*/
 		
 		sid_parse(pdata+4,sid_len,&sid);
-		DEBUGADD(2,("SID: %s\n",sid_string_static(&sid)));
+		DEBUGADD(10,("SID: %s\n",sid_string_static(&sid)));
 
-		if (NT_STATUS_IS_ERR(sid_to_uid(&sid, &uid))) {
+		if (!NT_STATUS_IS_OK(sid_to_uid(&sid, &uid))) {
 			DEBUG(0,("sid_to_uid: failed, sid[%s]\n",
 				sid_string_static(&sid)));
 			uid = (-1);
diff --git a/source/smbd/posix_acls.c b/source/smbd/posix_acls.c
index 12eef46595d..95b45fcc997 100644
--- a/source/smbd/posix_acls.c
+++ b/source/smbd/posix_acls.c
@@ -42,10 +42,448 @@ typedef struct canon_ace {
 	enum ace_owner owner_type;
 	enum ace_attribute attr;
 	posix_id unix_ug; 
+	BOOL inherited;
 } canon_ace;
 
 #define ALL_ACE_PERMS (S_IRUSR|S_IWUSR|S_IXUSR)
 
+/*
+ * EA format of user.SAMBA_PAI (Samba_Posix_Acl_Interitance)
+ * attribute on disk.
+ *
+ * |  1   |  1   |   2         |         2           |  .... 
+ * +------+------+-------------+---------------------+-------------+--------------------+
+ * | vers | flag | num_entries | num_default_entries | ..entries.. | default_entries... |
+ * +------+------+-------------+---------------------+-------------+--------------------+
+ */
+
+#define SAMBA_POSIX_INHERITANCE_EA_NAME "user.SAMBA_PAI"
+
+#define PAI_VERSION_OFFSET	0
+#define PAI_FLAG_OFFSET		1
+#define PAI_NUM_ENTRIES_OFFSET	2
+#define PAI_NUM_DEFAULT_ENTRIES_OFFSET	4
+#define PAI_ENTRIES_BASE	6
+
+#define PAI_VERSION		1
+#define PAI_ACL_FLAG_PROTECTED	0x1
+#define PAI_ENTRY_LENGTH	5
+
+/*
+ * In memory format of user.SAMBA_PAI attribute.
+ */
+
+struct pai_entry {
+	struct pai_entry *next, *prev;
+	enum ace_owner owner_type;
+	posix_id unix_ug; 
+};
+	
+struct pai_val {
+	BOOL protected;
+	unsigned int num_entries;
+	struct pai_entry *entry_list;
+	unsigned int num_def_entries;
+	struct pai_entry *def_entry_list;
+};
+
+/************************************************************************
+ Return a uint32 of the pai_entry principal.
+************************************************************************/
+
+static uint32 get_pai_entry_val(struct pai_entry *paie)
+{
+	switch (paie->owner_type) {
+		case UID_ACE:
+			DEBUG(10,("get_pai_entry_val: uid = %u\n", (unsigned int)paie->unix_ug.uid ));
+			return (uint32)paie->unix_ug.uid;
+		case GID_ACE:
+			DEBUG(10,("get_pai_entry_val: gid = %u\n", (unsigned int)paie->unix_ug.gid ));
+			return (uint32)paie->unix_ug.gid;
+		case WORLD_ACE:
+		default:
+			DEBUG(10,("get_pai_entry_val: world ace\n"));
+			return (uint32)-1;
+	}
+}
+
+/************************************************************************
+ Return a uint32 of the entry principal.
+************************************************************************/
+
+static uint32 get_entry_val(canon_ace *ace_entry)
+{
+	switch (ace_entry->owner_type) {
+		case UID_ACE:
+			DEBUG(10,("get_entry_val: uid = %u\n", (unsigned int)ace_entry->unix_ug.uid ));
+			return (uint32)ace_entry->unix_ug.uid;
+		case GID_ACE:
+			DEBUG(10,("get_entry_val: gid = %u\n", (unsigned int)ace_entry->unix_ug.gid ));
+			return (uint32)ace_entry->unix_ug.gid;
+		case WORLD_ACE:
+		default:
+			DEBUG(10,("get_entry_val: world ace\n"));
+			return (uint32)-1;
+	}
+}
+
+/************************************************************************
+ Count the inherited entries.
+************************************************************************/
+
+static unsigned int num_inherited_entries(canon_ace *ace_list)
+{
+	unsigned int num_entries = 0;
+
+	for (; ace_list; ace_list = ace_list->next)
+		if (ace_list->inherited)
+			num_entries++;
+	return num_entries;
+}
+
+/************************************************************************
+ Create the on-disk format. Caller must free.
+************************************************************************/
+
+static char *create_pai_buf(canon_ace *file_ace_list, canon_ace *dir_ace_list, BOOL protected, size_t *store_size)
+{
+	char *pai_buf = NULL;
+	canon_ace *ace_list = NULL;
+	char *entry_offset = NULL;
+	unsigned int num_entries = 0;
+	unsigned int num_def_entries = 0;
+
+	for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next)
+		if (ace_list->inherited)
+			num_entries++;
+
+	for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next)
+		if (ace_list->inherited)
+			num_def_entries++;
+
+	DEBUG(10,("create_pai_buf: num_entries = %u, num_def_entries = %u\n", num_entries, num_def_entries ));
+
+	*store_size = PAI_ENTRIES_BASE + ((num_entries + num_def_entries)*PAI_ENTRY_LENGTH);
+
+	pai_buf = malloc(*store_size);
+	if (!pai_buf) {
+		return NULL;
+	}
+
+	/* Set up the header. */
+	memset(pai_buf, '\0', PAI_ENTRIES_BASE);
+	SCVAL(pai_buf,PAI_VERSION_OFFSET,PAI_VERSION);
+	SCVAL(pai_buf,PAI_FLAG_OFFSET,(protected ? PAI_ACL_FLAG_PROTECTED : 0));
+	SSVAL(pai_buf,PAI_NUM_ENTRIES_OFFSET,num_entries);
+	SSVAL(pai_buf,PAI_NUM_DEFAULT_ENTRIES_OFFSET,num_def_entries);
+
+	entry_offset = pai_buf + PAI_ENTRIES_BASE;
+
+	for (ace_list = dir_ace_list; ace_list; ace_list = ace_list->next) {
+		if (ace_list->inherited) {
+			uint8 type_val = (unsigned char)ace_list->owner_type;
+			uint32 entry_val = get_entry_val(ace_list);
+
+			SCVAL(entry_offset,0,type_val);
+			SIVAL(entry_offset,1,entry_val);
+			entry_offset += PAI_ENTRY_LENGTH;
+		}
+	}
+
+	for (ace_list = file_ace_list; ace_list; ace_list = ace_list->next) {
+		if (ace_list->inherited) {
+			uint8 type_val = (unsigned char)ace_list->owner_type;
+			uint32 entry_val = get_entry_val(ace_list);
+
+			SCVAL(entry_offset,0,type_val);
+			SIVAL(entry_offset,1,entry_val);
+			entry_offset += PAI_ENTRY_LENGTH;
+		}
+	}
+
+	return pai_buf;
+}
+
+/************************************************************************
+ Store the user.SAMBA_PAI attribute on disk.
+************************************************************************/
+
+static void store_inheritance_attributes(files_struct *fsp, canon_ace *file_ace_list,
+					canon_ace *dir_ace_list, BOOL protected)
+{
+	int ret;
+	size_t store_size;
+	char *pai_buf;
+
+	if (!lp_map_acl_inherit(SNUM(fsp->conn)))
+		return;
+
+	/*
+	 * Don't store if this ACL isn't protected and
+	 * none of the entries in it are marked as inherited.
+	 */
+
+	if (!protected && num_inherited_entries(file_ace_list) == 0 && num_inherited_entries(dir_ace_list) == 0) {
+		/* Instead just remove the attribute if it exists. */
+		if (fsp->fd != -1)
+			SMB_VFS_FREMOVEXATTR(fsp, fsp->fd, SAMBA_POSIX_INHERITANCE_EA_NAME);
+		else
+			SMB_VFS_REMOVEXATTR(fsp->conn, fsp->fsp_name, SAMBA_POSIX_INHERITANCE_EA_NAME);
+		return;
+	}
+
+	pai_buf = create_pai_buf(file_ace_list, dir_ace_list, protected, &store_size);
+
+	if (fsp->fd != -1)
+		ret = SMB_VFS_FSETXATTR(fsp, fsp->fd, SAMBA_POSIX_INHERITANCE_EA_NAME,
+				pai_buf, store_size, 0);
+	else
+		ret = SMB_VFS_SETXATTR(fsp->conn,fsp->fsp_name, SAMBA_POSIX_INHERITANCE_EA_NAME,
+				pai_buf, store_size, 0);
+
+	SAFE_FREE(pai_buf);
+
+	DEBUG(10,("store_inheritance_attribute:%s for file %s\n", protected ? " (protected)" : "", fsp->fsp_name));
+	if (ret == -1 && errno != ENOSYS)
+		DEBUG(1,("store_inheritance_attribute: Error %s\n", strerror(errno) ));
+}
+
+/************************************************************************
+ Delete the in memory inheritance info.
+************************************************************************/
+
+static void free_inherited_info(struct pai_val *pal)
+{
+	if (pal) {
+		struct pai_entry *paie, *paie_next;
+		for (paie = pal->entry_list; paie; paie = paie_next) {
+			paie_next = paie->next;
+			SAFE_FREE(paie);
+		}
+		for (paie = pal->def_entry_list; paie; paie = paie_next) {
+			paie_next = paie->next;
+			SAFE_FREE(paie);
+		}
+		SAFE_FREE(pal);
+	}
+}
+
+/************************************************************************
+ Was this ACL protected ?
+************************************************************************/
+
+static BOOL get_protected_flag(struct pai_val *pal)
+{
+	if (!pal)
+		return False;
+	return pal->protected;
+}
+
+/************************************************************************
+ Was this ACE inherited ?
+************************************************************************/
+
+static BOOL get_inherited_flag(struct pai_val *pal, canon_ace *ace_entry, BOOL default_ace)
+{
+	struct pai_entry *paie;
+
+	if (!pal)
+		return False;
+
+	/* If the entry exists it is inherited. */
+	for (paie = (default_ace ? pal->def_entry_list : pal->entry_list); paie; paie = paie->next) {
+		if (ace_entry->owner_type == paie->owner_type &&
+				get_entry_val(ace_entry) == get_pai_entry_val(paie))
+			return True;
+	}
+	return False;
+}
+
+/************************************************************************
+ Ensure an attribute just read is valid.
+************************************************************************/
+
+static BOOL check_pai_ok(char *pai_buf, size_t pai_buf_data_size)
+{
+	uint16 num_entries;
+	uint16 num_def_entries;
+
+	if (pai_buf_data_size < PAI_ENTRIES_BASE) {
+		/* Corrupted - too small. */
+		return False;
+	}
+
+	if (CVAL(pai_buf,PAI_VERSION_OFFSET) != PAI_VERSION)
+		return False;
+
+	num_entries = SVAL(pai_buf,PAI_NUM_ENTRIES_OFFSET);
+	num_def_entries = SVAL(pai_buf,PAI_NUM_DEFAULT_ENTRIES_OFFSET);
+
+	/* Check the entry lists match. */
+	/* Each entry is 5 bytes (type plus 4 bytes of uid or gid). */
+
+	if (((num_entries + num_def_entries)*PAI_ENTRY_LENGTH) + PAI_ENTRIES_BASE != pai_buf_data_size)
+		return False;
+
+	return True;
+}
+
+
+/************************************************************************
+ Convert to in-memory format.
+************************************************************************/
+
+static struct pai_val *create_pai_val(char *buf, size_t size)
+{
+	char *entry_offset;
+	struct pai_val *paiv = NULL;
+	int i;
+
+	if (!check_pai_ok(buf, size))
+		return NULL;
+
+	paiv = malloc(sizeof(struct pai_val));
+	if (!paiv)
+		return NULL;
+
+	memset(paiv, '\0', sizeof(struct pai_val));
+
+	paiv->protected = (CVAL(buf,PAI_FLAG_OFFSET) == PAI_ACL_FLAG_PROTECTED);
+
+	paiv->num_entries = SVAL(buf,PAI_NUM_ENTRIES_OFFSET);
+	paiv->num_def_entries = SVAL(buf,PAI_NUM_DEFAULT_ENTRIES_OFFSET);
+
+	entry_offset = buf + PAI_ENTRIES_BASE;
+
+	DEBUG(10,("create_pai_val:%s num_entries = %u, num_def_entries = %u\n",
+			paiv->protected ? " (protected)" : "", paiv->num_entries, paiv->num_def_entries ));
+
+	for (i = 0; i < paiv->num_entries; i++) {
+		struct pai_entry *paie;
+
+		paie = malloc(sizeof(struct pai_entry));
+		if (!paie) {
+			free_inherited_info(paiv);
+			return NULL;
+		}
+
+		paie->owner_type = (enum ace_owner)CVAL(entry_offset,0);
+		switch( paie->owner_type) {
+			case UID_ACE:
+				paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1);
+				DEBUG(10,("create_pai_val: uid = %u\n", (unsigned int)paie->unix_ug.uid ));
+				break;
+			case GID_ACE:
+				paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1);
+				DEBUG(10,("create_pai_val: gid = %u\n", (unsigned int)paie->unix_ug.gid ));
+				break;
+			case WORLD_ACE:
+				paie->unix_ug.world = -1;
+				DEBUG(10,("create_pai_val: world ace\n"));
+				break;
+			default:
+				free_inherited_info(paiv);
+				return NULL;
+		}
+		entry_offset += PAI_ENTRY_LENGTH;
+		DLIST_ADD(paiv->entry_list, paie);
+	}
+
+	for (i = 0; i < paiv->num_def_entries; i++) {
+		struct pai_entry *paie;
+
+		paie = malloc(sizeof(struct pai_entry));
+		if (!paie) {
+			free_inherited_info(paiv);
+			return NULL;
+		}
+
+		paie->owner_type = (enum ace_owner)CVAL(entry_offset,0);
+		switch( paie->owner_type) {
+			case UID_ACE:
+				paie->unix_ug.uid = (uid_t)IVAL(entry_offset,1);
+				DEBUG(10,("create_pai_val: (def) uid = %u\n", (unsigned int)paie->unix_ug.uid ));
+				break;
+			case GID_ACE:
+				paie->unix_ug.gid = (gid_t)IVAL(entry_offset,1);
+				DEBUG(10,("create_pai_val: (def) gid = %u\n", (unsigned int)paie->unix_ug.gid ));
+				break;
+			case WORLD_ACE:
+				paie->unix_ug.world = -1;
+				DEBUG(10,("create_pai_val: (def) world ace\n"));
+				break;
+			default:
+				free_inherited_info(paiv);
+				return NULL;
+		}
+		entry_offset += PAI_ENTRY_LENGTH;
+		DLIST_ADD(paiv->def_entry_list, paie);
+	}
+
+	return paiv;
+}
+
+/************************************************************************
+ Load the user.SAMBA_PAI attribute.
+************************************************************************/
+
+static struct pai_val *load_inherited_info(files_struct *fsp)
+{
+	char *pai_buf;
+	size_t pai_buf_size = 1024;
+	struct pai_val *paiv = NULL;
+	ssize_t ret;
+
+	if (!lp_map_acl_inherit(SNUM(fsp->conn)))
+		return NULL;
+
+	if ((pai_buf = malloc(pai_buf_size)) == NULL)
+		return NULL;
+
+	do {
+		if (fsp->fd != -1)
+			ret = SMB_VFS_FGETXATTR(fsp, fsp->fd, SAMBA_POSIX_INHERITANCE_EA_NAME,
+					pai_buf, pai_buf_size);
+		else
+			ret = SMB_VFS_GETXATTR(fsp->conn,fsp->fsp_name,SAMBA_POSIX_INHERITANCE_EA_NAME,
+					pai_buf, pai_buf_size);
+
+		if (ret == -1) {
+			if (errno != ERANGE) {
+				break;
+			}
+			/* Buffer too small - enlarge it. */
+			pai_buf_size *= 2;
+			SAFE_FREE(pai_buf);
+			if ((pai_buf = malloc(pai_buf_size)) == NULL)
+				return NULL;
+		}
+	} while (ret == -1);
+
+	DEBUG(10,("load_inherited_info: ret = %d for file %s\n", ret, fsp->fsp_name));
+
+	if (ret == -1) {
+		/* No attribute or not supported. */
+#if defined(ENOATTR)
+		if (errno != ENOATTR)
+			DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
+#else
+		if (errno != ENOSYS)
+			DEBUG(10,("load_inherited_info: Error %s\n", strerror(errno) ));
+#endif
+		SAFE_FREE(pai_buf);
+		return NULL;
+	}
+
+	paiv = create_pai_val(pai_buf, ret);
+
+	if (paiv && paiv->protected)
+		DEBUG(10,("load_inherited_info: ACL is protected for file %s\n", fsp->fsp_name));
+
+	SAFE_FREE(pai_buf);
+	return paiv;
+}
+
 /****************************************************************************
  Functions to manipulate the internal ACE format.
 ****************************************************************************/
@@ -106,10 +544,10 @@ static void print_canon_ace(canon_ace *pace, int num)
 	dbgtext( "SID = %s ", sid_to_string( str, &pace->trustee));
 	if (pace->owner_type == UID_ACE) {
 		const char *u_name = uidtoname(pace->unix_ug.uid);
-		dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name);
+		dbgtext( "uid %u (%s) ", (unsigned int)pace->unix_ug.uid, u_name );
 	} else if (pace->owner_type == GID_ACE) {
 		char *g_name = gidtoname(pace->unix_ug.gid);
-		dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name);
+		dbgtext( "gid %u (%s) ", (unsigned int)pace->unix_ug.gid, g_name );
 	} else
 		dbgtext( "other ");
 	switch (pace->type) {
@@ -129,6 +567,8 @@ static void print_canon_ace(canon_ace *pace, int num)
 			dbgtext( "SMB_ACL_OTHER ");
 			break;
 	}
+	if (pace->inherited)
+		dbgtext( "(inherited) ");
 	dbgtext( "perms ");
 	dbgtext( "%c", pace->perms & S_IRUSR ? 'r' : '-');
 	dbgtext( "%c", pace->perms & S_IWUSR ? 'w' : '-');
@@ -468,7 +908,7 @@ static BOOL unpack_nt_owners(SMB_STRUCT_STAT *psbuf, uid_t *puser, gid_t *pgrp,
 
 	if (security_info_sent & OWNER_SECURITY_INFORMATION) {
 		sid_copy(&owner_sid, psd->owner_sid);
-		if (NT_STATUS_IS_ERR(sid_to_uid(&owner_sid, puser))) {
+		if (!NT_STATUS_IS_OK(sid_to_uid(&owner_sid, puser))) {
 #if ACL_FORCE_UNMAPPABLE
 			/* this allows take ownership to work reasonably */
 			extern struct current_user current_user;
@@ -488,7 +928,7 @@ static BOOL unpack_nt_owners(SMB_STRUCT_STAT *psbuf, uid_t *puser, gid_t *pgrp,
 
 	if (security_info_sent & GROUP_SECURITY_INFORMATION) {
 		sid_copy(&grp_sid, psd->grp_sid);
-		if (NT_STATUS_IS_ERR(sid_to_gid( &grp_sid, pgrp))) {
+		if (!NT_STATUS_IS_OK(sid_to_gid( &grp_sid, pgrp))) {
 #if ACL_FORCE_UNMAPPABLE
 			/* this allows take group ownership to work reasonably */
 			extern struct current_user current_user;
@@ -766,7 +1206,7 @@ static void check_owning_objs(canon_ace *ace, DOM_SID *pfile_owner_sid, DOM_SID
  Unpack a SEC_DESC into two canonical ace lists.
 ****************************************************************************/
 
-static BOOL create_canon_ace_lists(files_struct *fsp, 
+static BOOL create_canon_ace_lists(files_struct *fsp, SMB_STRUCT_STAT *pst,
 							DOM_SID *pfile_owner_sid,
 							DOM_SID *pfile_grp_sid,
 							canon_ace **ppfile_ace, canon_ace **ppdir_ace,
@@ -901,7 +1341,7 @@ static BOOL create_canon_ace_lists(files_struct *fsp,
 			current_ace->type = SMB_ACL_OTHER;
 		} else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Owner)) {
 			current_ace->owner_type = UID_ACE;
-			current_ace->unix_ug.world = -1;
+			current_ace->unix_ug.uid = pst->st_uid;
 			current_ace->type = SMB_ACL_USER_OBJ;
 
 			/*
@@ -914,7 +1354,7 @@ static BOOL create_canon_ace_lists(files_struct *fsp,
 				psa->flags |= SEC_ACE_FLAG_INHERIT_ONLY;
 		} else if (sid_equal(&current_ace->trustee, &global_sid_Creator_Group)) {
 			current_ace->owner_type = GID_ACE;
-			current_ace->unix_ug.world = -1;
+			current_ace->unix_ug.gid = pst->st_gid;
 			current_ace->type = SMB_ACL_GROUP_OBJ;
 
 			/*
@@ -949,6 +1389,7 @@ static BOOL create_canon_ace_lists(files_struct *fsp,
 
 		current_ace->perms |= map_nt_perms( psa->info, S_IRUSR);
 		current_ace->attr = (psa->type == SEC_ACE_TYPE_ACCESS_ALLOWED) ? ALLOW_ACE : DENY_ACE;
+		current_ace->inherited = ((psa->flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False);
 
 		/*
 		 * Now add the created ace to either the file list, the directory
@@ -1473,7 +1914,7 @@ static BOOL unpack_canon_ace(files_struct *fsp,
 	 * Now go through the DACL and create the canon_ace lists.
 	 */
 
-	if (!create_canon_ace_lists( fsp, pfile_owner_sid, pfile_grp_sid,
+	if (!create_canon_ace_lists( fsp, pst, pfile_owner_sid, pfile_grp_sid,
 								&file_ace, &dir_ace, psd->dacl))
 		return False;
 
@@ -1616,7 +2057,7 @@ static void arrange_posix_perms( char *filename, canon_ace **pp_list_head)
 ****************************************************************************/
 
 static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_STRUCT_STAT *psbuf,
-					DOM_SID *powner, DOM_SID *pgroup, SMB_ACL_TYPE_T the_acl_type)
+					DOM_SID *powner, DOM_SID *pgroup, struct pai_val *pal, SMB_ACL_TYPE_T the_acl_type)
 {
 	extern DOM_SID global_sid_World;
 	connection_struct *conn = fsp->conn;
@@ -1723,6 +2164,7 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_
 		ace->trustee = sid;
 		ace->unix_ug = unix_ug;
 		ace->owner_type = owner_type;
+		ace->inherited = get_inherited_flag(pal, ace, (the_acl_type == SMB_ACL_TYPE_DEFAULT));
 
 		DLIST_ADD(list_head, ace);
 	}
@@ -1734,14 +2176,12 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_
 	if (!ensure_canon_entry_valid(&list_head, fsp, powner, pgroup, psbuf, False))
 		goto fail;
 
-	arrange_posix_perms(fsp->fsp_name,&list_head );
-
 	/*
 	 * Now go through the list, masking the permissions with the
 	 * acl_mask. Ensure all DENY Entries are at the start of the list.
 	 */
 
-	DEBUG(10,("canonicalise_acl: ace entries before arrange :\n"));
+	DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", the_acl_type == SMB_ACL_TYPE_ACCESS ? "Access" : "Default" ));
 
 	for ( ace_count = 0, ace = list_head; ace; ace = next_ace, ace_count++) {
 		next_ace = ace->next;
@@ -1759,6 +2199,8 @@ static canon_ace *canonicalise_acl( files_struct *fsp, SMB_ACL_T posix_acl, SMB_
 		}
 	}
 
+	arrange_posix_perms(fsp->fsp_name,&list_head );
+
 	print_canon_ace_list( "canonicalise_acl: ace entries after arrange", list_head );
 
 	return list_head;
@@ -1908,6 +2350,7 @@ static BOOL set_canon_ace_list(files_struct *fsp, canon_ace *the_ace, BOOL defau
 
 		if( DEBUGLVL( 10 ))
 			print_canon_ace( p_ace, i);
+
 	}
 
 	if (needs_mask && !got_mask_entry) {
@@ -2109,16 +2552,6 @@ posix perms.\n", fsp->fsp_name ));
 	return True;
 }
 
-static int nt_ace_comp( SEC_ACE *a1, SEC_ACE *a2)
-{
-	if (a1->type == a2->type)
-		return 0;
-
-	if (a1->type == SEC_ACE_TYPE_ACCESS_DENIED && a2->type == SEC_ACE_TYPE_ACCESS_ALLOWED)
-		return -1;
-	return 1;
-}
-
 /****************************************************************************
   Incoming NT ACLs on a directory can be split into a default POSIX acl (CI|OI|IO) and
   a normal POSIX acl. Win2k needs these split acls re-merging into one ACL
@@ -2132,24 +2565,51 @@ static size_t merge_default_aces( SEC_ACE *nt_ace_list, size_t num_aces)
 
 	for (i = 0; i < num_aces; i++) {
 		for (j = i+1; j < num_aces; j++) {
+			uint32 i_flags_ni = (nt_ace_list[i].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
+			uint32 j_flags_ni = (nt_ace_list[j].flags & ~SEC_ACE_FLAG_INHERITED_ACE);
+			BOOL i_inh = (nt_ace_list[i].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
+			BOOL j_inh = (nt_ace_list[j].flags & SEC_ACE_FLAG_INHERITED_ACE) ? True : False;
+
 			/* We know the lower number ACE's are file entries. */
 			if ((nt_ace_list[i].type == nt_ace_list[j].type) &&
 				(nt_ace_list[i].size == nt_ace_list[j].size) &&
 				(nt_ace_list[i].info.mask == nt_ace_list[j].info.mask) &&
 				sid_equal(&nt_ace_list[i].trustee, &nt_ace_list[j].trustee) &&
-				(nt_ace_list[i].flags == 0) &&
-				(nt_ace_list[j].flags == (SEC_ACE_FLAG_OBJECT_INHERIT|
-							  SEC_ACE_FLAG_CONTAINER_INHERIT|
-							  SEC_ACE_FLAG_INHERIT_ONLY))) {
+				(i_inh == j_inh) &&
+				(i_flags_ni == 0) &&
+				(j_flags_ni == (SEC_ACE_FLAG_OBJECT_INHERIT|
+						  SEC_ACE_FLAG_CONTAINER_INHERIT|
+						  SEC_ACE_FLAG_INHERIT_ONLY))) {
 				/*
-				 * These are identical except for the flags.
-				 * Merge the inherited ACE onto the non-inherited ACE.
+				 * W2K wants to have access allowed zero access ACE's
+				 * at the end of the list. If the mask is zero, merge
+				 * the non-inherited ACE onto the inherited ACE.
 				 */
 
-				nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT;
-				if (num_aces - j - 1 > 0)
-					memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
-							sizeof(SEC_ACE));
+				if (nt_ace_list[i].info.mask == 0) {
+					nt_ace_list[j].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
+								(i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
+					if (num_aces - i - 1 > 0)
+						memmove(&nt_ace_list[i], &nt_ace_list[i+1], (num_aces-i-1) *
+								sizeof(SEC_ACE));
+
+					DEBUG(10,("merge_default_aces: Merging zero access ACE %u onto ACE %u.\n",
+						(unsigned int)i, (unsigned int)j ));
+				} else {
+					/*
+					 * These are identical except for the flags.
+					 * Merge the inherited ACE onto the non-inherited ACE.
+					 */
+
+					nt_ace_list[i].flags = SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
+								(i_inh ? SEC_ACE_FLAG_INHERITED_ACE : 0);
+					if (num_aces - j - 1 > 0)
+						memmove(&nt_ace_list[j], &nt_ace_list[j+1], (num_aces-j-1) *
+								sizeof(SEC_ACE));
+
+					DEBUG(10,("merge_default_aces: Merging ACE %u onto ACE %u.\n",
+						(unsigned int)j, (unsigned int)i ));
+				}
 				num_aces--;
 				break;
 			}
@@ -2186,7 +2646,9 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 	canon_ace *file_ace = NULL;
 	canon_ace *dir_ace = NULL;
 	size_t num_profile_acls = 0;
- 
+	struct pai_val *pal = NULL;
+	SEC_DESC *psd = NULL;
+
 	*ppdesc = NULL;
 
 	DEBUG(10,("get_nt_acl: called for file %s\n", fsp->fsp_name ));
@@ -2228,6 +2690,8 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 			posix_acl ? "present" :  "absent",
 			dir_acl ? "present" :  "absent" ));
 
+	pal = load_inherited_info(fsp);
+
 	/*
 	 * Get the owner, group and world SIDs.
 	 */
@@ -2241,7 +2705,7 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 		create_file_sids(&sbuf, &owner_sid, &group_sid);
 	}
 
-	if (security_info & DACL_SECURITY_INFORMATION) {
+	if ((security_info & DACL_SECURITY_INFORMATION) && !(security_info & PROTECTED_DACL_SECURITY_INFORMATION)) {
 
 		/*
 		 * In the optimum case Creator Owner and Creator Group would be used for
@@ -2253,7 +2717,7 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 		 */
 
 		/* Create the canon_ace lists. */
-		file_ace = canonicalise_acl( fsp, posix_acl, &sbuf, &owner_sid, &group_sid, SMB_ACL_TYPE_ACCESS );
+		file_ace = canonicalise_acl( fsp, posix_acl, &sbuf, &owner_sid, &group_sid, pal, SMB_ACL_TYPE_ACCESS );
 
 		/* We must have *some* ACLS. */
 	
@@ -2265,7 +2729,7 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 		if (fsp->is_directory && dir_acl) {
 			dir_ace = canonicalise_acl(fsp, dir_acl, &sbuf,
 					&global_sid_Creator_Owner,
-					&global_sid_Creator_Group, SMB_ACL_TYPE_DEFAULT );
+					&global_sid_Creator_Group, pal, SMB_ACL_TYPE_DEFAULT );
 		}
 
 		/*
@@ -2347,7 +2811,7 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 				SEC_ACCESS acc;
 
 				acc = map_canon_ace_perms(&nt_acl_type, &owner_sid, ace );
-				init_sec_ace(&nt_ace_list[num_aces++], &ace->trustee, nt_acl_type, acc, 0);
+				init_sec_ace(&nt_ace_list[num_aces++], &ace->trustee, nt_acl_type, acc, ace->inherited ? SEC_ACE_FLAG_INHERITED_ACE : 0);
 			}
 
 			/* The User must have access to a profile share - even if we can't map the SID. */
@@ -2355,7 +2819,8 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 				SEC_ACCESS acc;
 
 				init_sec_access(&acc,FILE_GENERIC_ALL);
-				init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, acc, 0);
+				init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED,
+						acc, 0);
 			}
 
 			ace = dir_ace;
@@ -2365,7 +2830,9 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 	
 				acc = map_canon_ace_perms(&nt_acl_type, &owner_sid, ace );
 				init_sec_ace(&nt_ace_list[num_aces++], &ace->trustee, nt_acl_type, acc,
-						SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|SEC_ACE_FLAG_INHERIT_ONLY);
+						SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
+						SEC_ACE_FLAG_INHERIT_ONLY|
+						(ace->inherited ? SEC_ACE_FLAG_INHERITED_ACE : 0));
 			}
 
 			/* The User must have access to a profile share - even if we can't map the SID. */
@@ -2375,7 +2842,7 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 				init_sec_access(&acc,FILE_GENERIC_ALL);
 				init_sec_ace(&nt_ace_list[num_aces++], &global_sid_Builtin_Users, SEC_ACE_TYPE_ACCESS_ALLOWED, acc,
 						SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT|
-						SEC_ACE_FLAG_INHERIT_ONLY);
+						SEC_ACE_FLAG_INHERIT_ONLY|0);
 			}
 
 			/*
@@ -2386,12 +2853,6 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 
 			num_aces = merge_default_aces(nt_ace_list, num_aces);
 
-			/*
-			 * Sort to force deny entries to the front.
-			 */
-	
-			if (num_aces)
-				qsort( nt_ace_list, num_aces, sizeof(nt_ace_list[0]), QSORT_CAST nt_ace_comp);
 		}
 
 		if (num_aces) {
@@ -2402,21 +2863,16 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 		}
 	} /* security_info & DACL_SECURITY_INFORMATION */
 
-	*ppdesc = make_standard_sec_desc( main_loop_talloc_get(),
+	psd = make_standard_sec_desc( main_loop_talloc_get(),
 			(security_info & OWNER_SECURITY_INFORMATION) ? &owner_sid : NULL,
 			(security_info & GROUP_SECURITY_INFORMATION) ? &group_sid : NULL,
 			psa,
 			&sd_size);
 
-	if(!*ppdesc) {
+	if(!psd) {
 		DEBUG(0,("get_nt_acl: Unable to malloc space for security descriptor.\n"));
 		sd_size = 0;
 	} else {
-#if 1
-		/*
-		 * JRA. Setting this flag causes W2K clients not to
-		 * propagate ACL sets down a directory tree correctly.
-		 */
 		/*
 		 * Windows 2000: The DACL_PROTECTED flag in the security
 		 * descriptor marks the ACL as non-inheriting, i.e., no
@@ -2426,10 +2882,15 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 		 * any ACEs that are inherited dynamically. The DACL_PROTECTED
 		 * flag doesn't seem to bother Windows NT.
 		 */
-		(*ppdesc)->type |= SE_DESC_DACL_PROTECTED;
-#endif
+		if (get_protected_flag(pal))
+			psd->type |= SE_DESC_DACL_PROTECTED;
 	}
 
+	if (psd->dacl)
+		dacl_sort_into_canonical_order(psd->dacl->ace, (unsigned int)psd->dacl->num_aces);
+
+	*ppdesc = psd;
+
  done:
 
 	if (posix_acl)
@@ -2438,6 +2899,7 @@ size_t get_nt_acl(files_struct *fsp, uint32 security_info, SEC_DESC **ppdesc)
 		SMB_VFS_SYS_ACL_FREE_ACL(conn, dir_acl);
 	free_canon_ace_list(file_ace);
 	free_canon_ace_list(dir_ace);
+	free_inherited_info(pal);
 	SAFE_FREE(nt_ace_list);
 
 	return sd_size;
@@ -2660,6 +3122,10 @@ BOOL set_nt_acl(files_struct *fsp, uint32 security_info_sent, SEC_DESC *psd)
 				}
 			}
 
+			if (acl_set_support)
+				store_inheritance_attributes(fsp, file_ace_list, dir_ace_list,
+						(psd->type & SE_DESC_DACL_PROTECTED) ? True : False);
+
 			/*
 			 * If we cannot set using POSIX ACLs we fall back to checking if we need to chmod.
 			 */
diff --git a/source/smbd/reply.c b/source/smbd/reply.c
index be51a328911..e7f01ad02fe 100644
--- a/source/smbd/reply.c
+++ b/source/smbd/reply.c
@@ -39,7 +39,7 @@ unsigned int smb_echo_count = 0;
 extern BOOL global_encrypted_passwords_negotiated;
 
 /****************************************************************************
- Reply to an special message.
+ Reply to a special message.
 ****************************************************************************/
 
 int reply_special(char *inbuf,char *outbuf)
diff --git a/source/smbd/server.c b/source/smbd/server.c
index 07723cc20e7..a767014232b 100644
--- a/source/smbd/server.c
+++ b/source/smbd/server.c
@@ -845,8 +845,12 @@ void build_options(BOOL screen);
 	if(!initialize_password_db(False))
 		exit(1);
 
-	if (!idmap_init())
-		exit(1);
+	{
+		const char *idmap_back = lp_idmap_backend();
+
+		if (!idmap_init((idmap_back && *idmap_back) ? "winbind" : NULL))
+			exit(1);
+	}
 
 	if (!idmap_init_wellknown_sids())
 		exit(1);
@@ -855,8 +859,6 @@ void build_options(BOOL screen);
 
 	init_modules();
 
-	uni_group_cache_init(); /* Non-critical */
-	
 	/* possibly reload the services file. */
 	reload_services(True);
 
@@ -891,7 +893,6 @@ void build_options(BOOL screen);
 
 	smbd_process();
 	
-	uni_group_cache_shutdown();
 	namecache_shutdown();
 	exit_server("normal exit");
 	return(0);
diff --git a/source/smbd/service.c b/source/smbd/service.c
index 31bb343474b..11659f28706 100644
--- a/source/smbd/service.c
+++ b/source/smbd/service.c
@@ -366,6 +366,8 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser,
 		}
 		fstrcpy(user,pass->pw_name);
 		conn->force_user = True;
+		conn->uid = pass->pw_uid;
+		conn->gid = pass->pw_gid;
 		string_set(&conn->user,pass->pw_name);
 		passwd_free(&pass);
 		DEBUG(3,("Guest only user %s\n",user));