Why Does a Restored Folder Keep Explicit ACLs but Lose Parent Inheritance?

Eva Wong

IceWhale author

Eva Wong is the Technical Writer and resident tinkerer at ZimaSpace. A lifelong geek with a passion for homelabs and open-source software, she specializes in translating complex technical concepts into accessible, hands-on guides. Eva believes that self-hosting should be fun, not intimidating. Through her tutorials, she empowers the community to demystify hardware setups, from building their first NAS to mastering Docker containers.

Why Does a Restored Folder Keep Explicit ACLs but Lose Parent Inheritance? - Zima Store Online

A restored folder can keep explicit permissions yet lose parent inheritance when the restore recreates its saved ACL as protected or omits inheritance metadata.

File content, ownership, explicit access entries, and inheritance state are separate restore results. A backup may correctly restore named users and groups while preserving a “protected” ACL that no longer accepts rules from the new parent. On POSIX filesystems, the restored directory may also lack a default ACL; on NFSv4 or SMB-backed datasets, inheritance flags can be changed or mapped differently. Compare the restored folder with one newly created sibling before applying recursive permission changes.

Compare the Restored Folder With a Newly Created Sibling

Create a disposable folder under the same parent using the same SMB or local identity. Compare owner, group, mode, complete ACL, default ACL, inheritance flags, and effective access.

Microsoft documents that restored or moved folders may retain protected permissions instead of automatically receiving the current parent ACL.

If the new sibling inherits correctly while the restored folder does not, the parent is probably configured correctly. Focus on the restored object’s protection state and saved ACL rather than rebuilding the entire share.

Separate Explicit ACL Entries From Inherited Entries

List every access entry and mark whether it is explicit, inherited, deny, allow, file-only, directory-only, or inheritance-capable. Do not rely only on effective access for one administrator account.

Red Hat explains that a directory default ACL controls inheritance for newly created files and subdirectories on POSIX ACL filesystems.

A folder can have a valid access ACL but no default ACL, allowing current access while preventing future children from receiving the intended rules. Repair both current access and future inheritance.

Check Whether the Restore Preserved a Protected Windows ACL

Inspect whether inheritance is disabled while previously inherited entries were converted into explicit entries. This commonly makes the restored folder look correct until the parent ACL changes.

Samba’s Windows ACL guidance describes Windows ACL handling on Samba shares, where inheritance and full security descriptors depend on the share and filesystem configuration.

Do not delete all explicit entries just to re-enable inheritance. Preserve entries that are intentionally unique to the restored folder and remove protection only after documenting the expected parent relationship.

-15% OFF

ZimaBoard 2 - Mini Home Server for Your Big Idea

Single board computer zimaboard2

Verify the Dataset ACL Model and Inheritance Flags

Record whether the destination uses POSIX ACLs, NFSv4 ACLs, Windows ACLs stored in extended attributes, or a NAS-specific preset. Compare it with the original backup destination.

The FreeBSD ZFS handbook notes that ZFS can store NFSv4-style ACLs natively, including inheritance behavior that is richer than traditional owner, group, and other mode bits.

Restoring an ACL created under one model into another can preserve some identities while losing inheritance semantics. Keep the restore in a test dataset when the source and destination ACL models differ.

Check the Restore Tool’s ACL and Extended-Attribute Options

Review the exact backup and restore options used for ACLs, extended attributes, ownership, numeric IDs, security descriptors, and platform-specific metadata. Compare them with the tool’s defaults.

The Linux ACL manual explains that new objects inherit a directory default ACL, but a restored object is not necessarily created through the same ordinary creation path.

A restore that writes a saved access ACL after creating the directory can replace what the parent initially supplied. Determine whether the tool intentionally restores the old ACL or should allow the new parent to govern inheritance.

Verify That the Backup Format Stored ACL Metadata

Inspect one backup object or archive listing for ACL and xattr records. Do not assume an archive that contains ownership and mode bits also contains complete access-control metadata.

GNU tar requires the ACL restore option to store and extract POSIX ACL entries.

If inheritance metadata was never stored, reconstruct it from the intended parent policy rather than guessing from one restored child. Keep a pre-repair ACL export for rollback.

Repair One Test Folder Before Applying a Recursive Change

Export the current ACL, re-enable inheritance or recreate the default ACL on one test folder, preserve required explicit entries, and create new child files through SMB and local application paths.

The ZimaSpace article on permissions breaking after a NAS move covers the wider transfer problem; this article isolates inheritance lost after a restore.

The issue is resolved when existing access remains correct, new children inherit the intended rules, and the result survives reconnect, reboot, and a small repeat restore.