python/ntacls: we only need security.SEC_STD_READ_CONTROL in order to get the ACL

We should avoid security.SEC_FLAG_MAXIMUM_ALLOWED otherwise
we may get NT_STATUS_SHARING_VIOLATION when we run
'samba-tool domain backup online' against a Windows DC.
Windows DCs have hidden folders for the NtFrs or Dfsr services,
which are locked by the running service.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13917

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 15032ec6df1abbb53f1b1d5377aab369f83ae707)

diff --git a/python/samba/ntacls.py b/python/samba/ntacls.py
index 32ceb54fd1b63c09f682279e5172ca489e35ffcd..b3a9c276955a135ca6436cdd52d0f0c7d7f59d85 100644 (file)
--- a/python/samba/ntacls.py
+++ b/python/samba/ntacls.py
@@ -48,7 +48,7 @@ SECURITY_SECINFO_FLAGS = security.SECINFO_OWNER | \
 
 # SEC_FLAG_SYSTEM_SECURITY is required otherwise get Access Denied
 SECURITY_SEC_FLAGS = security.SEC_FLAG_SYSTEM_SECURITY | \
-                     security.SEC_FLAG_MAXIMUM_ALLOWED
+                     security.SEC_STD_READ_CONTROL
 
 
 class XattrBackendError(Exception):