5.17. Can a process inherit file ACLs from its parent?

Yes. Up until version 0.9.12-2.2.18, this was the default behavior. Now the default is for children not to inherit the file ACLs from their parents. To allow a file ACL to be passed from a parent process to a child process, you must use the "-i <inheritance level>" option.

Where "inheritance level" (a.k.a. TTL) determines how far the ACL is inherited. If the TTL specified is 1, then the subject specified in the ACL and all of its children will inherit the ACL. However, the children's children (a.k.a. a grandchild of the subject in the ACL) will not inherit the ACL (a TTL of 2 would be needed for this to occur).

Note: These same inheritance rules apply to ACLs that grant capabilities.

SECURITY UPDATE: Starting with LIDS 1.1.1preX and 0.10.1, only protected programs are allowed inherit ACLs from their parent. Allowing non-protected processes to inherit ACLs led to an exploit.