I'm digging into the powerful but rather complex world of Windows file/folder security. I pretty much understand how it all works and can make some educated guesses how the ACL/ACE mechanism works. What I'm not sure about is how the inheritence flag/mechanism is implemented.
If (say) a folder object has the inheritence flag set, do changes to the parent:
- Get copied down to all effected child objects at the time the change to the parent permission is made?
- Does Windows, when required (e.g. checking permission) walk back up the tree to determine the inherited permission?
I'm suspecting it's #1 as if you change the security permissions at the root of a large file system, it takes a long time to apply the changes. I'm assuming that Windows is walking down through all files & folders, checking the inheritence flag and changing the ACL/ACE on each object.
I further assume it's done this way to improve performance - continually walking up a very deep folder structure to get the root object as that's where the permissions are inherited from would impose quite a big performance impact.