# Separate new-child inheritance from existing Data Lake ACL remediation

> Test old and newly created children separately after changing a Data Lake Storage directory's default ACL.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:31:39+00:00
- Modified: 2026-09-10T00:32:00+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Test old and newly created children separately after changing a Data Lake Storage directory's default ACL.

## Potentially affected

Azure Data Lake Storage directories governed by POSIX-style ACLs.

## DSE recommendation

Plan existing-child remediation separately from the default ACL applied to future children.

## Article

## Source facts

Data Lake Storage keeps an item’s permissions on that item. A directory’s default ACL supplies inheritance when a child is created; changing the default afterward does not update existing children. Existing access ACLs and default ACLs therefore require their own review.

When access is granted only through ACLs, a file reader or writer also needs Execute permission on the container root and every intervening directory. That qualification matters when testing the resulting access path. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control).

## Applicability

Apply this distinction to ACL-based directory permissions. Identify the caller and authorization route before testing, and record any broader role grants rather than assuming an access result came from the ACL alone.

## DSE recommendation

DSE recommends separating the change request into future-child defaults and the explicitly approved existing-child population. Inventory both before making changes. Have the data owner specify intended access for each population, and preserve the original ACLs so an incorrect broad change can be investigated and reversed deliberately.

## Verification

Use a controlled directory containing a preexisting file, then create a second file after the default change. Compare the stored permissions and actual authorized-user access for both. Check directory traversal separately, and include an unintended user in the denial test. Retain object paths and ACL evidence without copying sensitive file contents.

## Official references

[Microsoft Learn: Access control lists (ACLs) in Azure Data Lake Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control). Source retrieved September 9, 2026.

## Primary reference

- Name: Access control lists (ACLs) in Azure Data Lake Storage - Azure Storage | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-access-control
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate new-child inheritance from existing Data Lake ACL remediation,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-017-separate-new-child-inheritance-from-existing-data-lake-acl-remediation/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.