{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/", "slug": "dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation", "url": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/" }, "title": "Separate new-child inheritance from existing Data Lake ACL remediation", "summary": "Test old and newly created children separately after changing a Data Lake Storage directory's default ACL.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:39+00:00", "modified_at": "2026-09-10T00:32:00+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 227, "potentially_affected": "Azure Data Lake Storage directories governed by POSIX-style ACLs.", "dse_recommendation": "Plan existing-child remediation separately from the default ACL applied to future children.", "primary_source": { "name": "Access control lists (ACLs) in Azure Data Lake Storage - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Data Lake Storage keeps an item’s permissions on that item. A directory’s default ACL supplies inheritance when a child is created; changing the default afterward does not update existing children. Existing access ACLs and default ACLs therefore require their own review.

\n

When access is granted only through ACLs, a file reader or writer also needs Execute permission on the container root and every intervening directory. That qualification matters when testing the resulting access path. Microsoft Learn.

\n

Applicability

\n

Apply this distinction to ACL-based directory permissions. Identify the caller and authorization route before testing, and record any broader role grants rather than assuming an access result came from the ACL alone.

\n

DSE recommendation

\n

DSE recommends separating the change request into future-child defaults and the explicitly approved existing-child population. Inventory both before making changes. Have the data owner specify intended access for each population, and preserve the original ACLs so an incorrect broad change can be investigated and reversed deliberately.

\n

Verification

\n

Use a controlled directory containing a preexisting file, then create a second file after the default change. Compare the stored permissions and actual authorized-user access for both. Check directory traversal separately, and include an unintended user in the denial test. Retain object paths and ACL evidence without copying sensitive file contents.

\n

Official references

\n

Microsoft Learn: Access control lists (ACLs) in Azure Data Lake Storage. Source retrieved September 9, 2026.

", "content_text": "Source facts\nData Lake Storage keeps an item’s permissions on that item. A directory’s default ACL supplies inheritance when a child is created; changing the default afterward does not update existing children. Existing access ACLs and default ACLs therefore require their own review.\nWhen access is granted only through ACLs, a file reader or writer also needs Execute permission on the container root and every intervening directory. That qualification matters when testing the resulting access path. Microsoft Learn.\nApplicability\nApply this distinction to ACL-based directory permissions. Identify the caller and authorization route before testing, and record any broader role grants rather than assuming an access result came from the ACL alone.\nDSE recommendation\nDSE recommends separating the change request into future-child defaults and the explicitly approved existing-child population. Inventory both before making changes. Have the data owner specify intended access for each population, and preserve the original ACLs so an incorrect broad change can be investigated and reversed deliberately.\nVerification\nUse a controlled directory containing a preexisting file, then create a second file after the default change. Compare the stored permissions and actual authorized-user access for both. Check directory traversal separately, and include an unintended user in the denial test. Retain object paths and ACL evidence without copying sensitive file contents.\nOfficial references\nMicrosoft Learn: Access control lists (ACLs) in Azure Data Lake Storage. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nData Lake Storage keeps an item’s permissions on that item. A directory’s default ACL supplies inheritance when a child is created; changing the default afterward does not update existing children. Existing access ACLs and default ACLs therefore require their own review.\n\nWhen access is granted only through ACLs, a file reader or writer also needs Execute permission on the container root and every intervening directory. That qualification matters when testing the resulting access path. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control).\n\n## Applicability\n\nApply this distinction to ACL-based directory permissions. Identify the caller and authorization route before testing, and record any broader role grants rather than assuming an access result came from the ACL alone.\n\n## DSE recommendation\n\nDSE recommends separating the change request into future-child defaults and the explicitly approved existing-child population. Inventory both before making changes. Have the data owner specify intended access for each population, and preserve the original ACLs so an incorrect broad change can be investigated and reversed deliberately.\n\n## Verification\n\nUse a controlled directory containing a preexisting file, then create a second file after the default change. Compare the stored permissions and actual authorized-user access for both. Check directory traversal separately, and include an unintended user in the denial test. Retain object paths and ACL evidence without copying sensitive file contents.\n\n## Official references\n\n[Microsoft Learn: Access control lists (ACLs) in Azure Data Lake Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate new-child inheritance from existing Data Lake ACL remediation", "item": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/", "headline": "Separate new-child inheritance from existing Data Lake ACL remediation", "description": "Test old and newly created children separately after changing a Data Lake Storage directory's default ACL.", "abstract": "Test old and newly created children separately after changing a Data Lake Storage directory's default ACL.", "articleBody": "Source facts\nData Lake Storage keeps an item’s permissions on that item. A directory’s default ACL supplies inheritance when a child is created; changing the default afterward does not update existing children. Existing access ACLs and default ACLs therefore require their own review.\nWhen access is granted only through ACLs, a file reader or writer also needs Execute permission on the container root and every intervening directory. That qualification matters when testing the resulting access path. Microsoft Learn.\nApplicability\nApply this distinction to ACL-based directory permissions. Identify the caller and authorization route before testing, and record any broader role grants rather than assuming an access result came from the ACL alone.\nDSE recommendation\nDSE recommends separating the change request into future-child defaults and the explicitly approved existing-child population. Inventory both before making changes. Have the data owner specify intended access for each population, and preserve the original ACLs so an incorrect broad change can be investigated and reversed deliberately.\nVerification\nUse a controlled directory containing a preexisting file, then create a second file after the default change. Compare the stored permissions and actual authorized-user access for both. Check directory traversal separately, and include an unintended user in the denial test. Retain object paths and ACL evidence without copying sensitive file contents.\nOfficial references\nMicrosoft Learn: Access control lists (ACLs) in Azure Data Lake Storage. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:31:39+00:00", "dateModified": "2026-09-10T00:32:00+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate new-child inheritance from existing Data Lake ACL remediation" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 227, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Access control lists (ACLs) in Azure Data Lake Storage - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control" } } ] } }