4 files changed, 27 insertions, 0 deletions

diff --git a/src/wixext/Tuples/SecureObjectsTuple.cs b/src/wixext/Tuples/SecureObjectsTuple.cs
index 3602a5ea..95c24979 100644
--- a/src/wixext/Tuples/SecureObjectsTuple.cs
+++ b/src/wixext/Tuples/SecureObjectsTuple.cs
@@ -15,6 +15,7 @@ namespace WixToolset.Util
                 new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.Table), IntermediateFieldType.String),
                 new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.Domain), IntermediateFieldType.String),
                 new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.User), IntermediateFieldType.String),
+                new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.Attributes), IntermediateFieldType.Number),
                 new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.Permission), IntermediateFieldType.Number),
                 new IntermediateFieldDefinition(nameof(SecureObjectsTupleFields.ComponentRef), IntermediateFieldType.String),
             },
@@ -32,6 +33,7 @@ namespace WixToolset.Util.Tuples
         Table,
         Domain,
         User,
+        Attributes,
         Permission,
         ComponentRef,
     }
@@ -72,6 +74,12 @@ namespace WixToolset.Util.Tuples
             set => this.Set((int)SecureObjectsTupleFields.User, value);
         }
 
+        public int Attributes
+        {
+            get => this.Fields[(int)SecureObjectsTupleFields.Attributes].AsNumber();
+            set => this.Set((int)SecureObjectsTupleFields.Attributes, value);
+        }
+
         public int? Permission
         {
             get => this.Fields[(int)SecureObjectsTupleFields.Permission].AsNullableNumber();
diff --git a/src/wixext/UtilCompiler.cs b/src/wixext/UtilCompiler.cs
index 65ca406d..672c3f68 100644
--- a/src/wixext/UtilCompiler.cs
+++ b/src/wixext/UtilCompiler.cs
@@ -49,6 +49,11 @@ namespace WixToolset.Util
             TypeMask = 0xf,
         }
 
+        internal enum WixPermissionExAttributes
+        {
+            Inheritable = 0x01
+        }
+
         internal enum WixRemoveFolderExOn
         {
             Install = 1,
@@ -2367,6 +2372,8 @@ namespace WixToolset.Util
             string domain = null;
             string[] specialPermissions = null;
             string user = null;
+            var inheritable = YesNoType.NotSet;
+            int attributes = 0;
 
             var permissionType = PermissionType.SecureObjects;
 
@@ -2407,6 +2414,9 @@ namespace WixToolset.Util
                             }
                             domain = this.ParseHelper.GetAttributeValue(sourceLineNumbers, attrib);
                             break;
+                        case "Inheritable":
+                            inheritable = this.ParseHelper.GetAttributeYesNoValue(sourceLineNumbers, attrib);
+                            break;
                         case "User":
                             user = this.ParseHelper.GetAttributeValue(sourceLineNumbers, attrib);
                             break;
@@ -2444,6 +2454,8 @@ namespace WixToolset.Util
                 this.Messaging.Write(ErrorMessages.GenericReadNotAllowed(sourceLineNumbers));
             }
 
+            attributes |= inheritable == YesNoType.No ? 0 : (int)WixPermissionExAttributes.Inheritable; // default to inheritable.
+
             this.ParseHelper.ParseForExtensionElements(this.Context.Extensions, intermediate, section, element);
 
             if (!this.Messaging.EncounteredError)
@@ -2457,6 +2469,7 @@ namespace WixToolset.Util
                     Table = tableName,
                     Domain = domain,
                     User = user,
+                    Attributes = attributes,
                     Permission = permission,
                     ComponentRef = componentId,
                 });
diff --git a/src/wixext/UtilTableDefinitions.cs b/src/wixext/UtilTableDefinitions.cs
index 5e227a05..4dfeb4bd 100644
--- a/src/wixext/UtilTableDefinitions.cs
+++ b/src/wixext/UtilTableDefinitions.cs
@@ -164,6 +164,7 @@ namespace WixToolset.Util
                 new ColumnDefinition("Table", ColumnType.String, 32, primaryKey: true, nullable: false, ColumnCategory.Text, description: "Table SecureObject should be securing"),
                 new ColumnDefinition("Domain", ColumnType.String, 255, primaryKey: true, nullable: true, ColumnCategory.Text, description: "Domain half of user account to secure", modularizeType: ColumnModularizeType.Property),
                 new ColumnDefinition("User", ColumnType.String, 255, primaryKey: true, nullable: false, ColumnCategory.Text, description: "User name half of user account to secure", modularizeType: ColumnModularizeType.Property),
+                new ColumnDefinition("Attributes", ColumnType.Number, 4, primaryKey: false, nullable: false, ColumnCategory.Integer, minValue: 0, maxValue: 2147483647, description: "A 32-bit word that specifies the attribute flags to be applied."),
                 new ColumnDefinition("Permission", ColumnType.Number, 4, primaryKey: false, nullable: true, ColumnCategory.Unknown, minValue: -2147483647, maxValue: 2147483647, description: "Permissions to grant to User"),
                 new ColumnDefinition("Component_", ColumnType.String, 72, primaryKey: false, nullable: false, ColumnCategory.Identifier, keyTable: "Component", keyColumn: 1, description: "Foreign key into the Component table used to determine install state", modularizeType: ColumnModularizeType.Column),
             },
diff --git a/src/wixext/util.xsd b/src/wixext/util.xsd
index a8c3d208..93cdd4ba 100644
--- a/src/wixext/util.xsd
+++ b/src/wixext/util.xsd
@@ -775,6 +775,11 @@
     <xs:complexType>
       <xs:attribute name="Domain" type="xs:string"></xs:attribute>
       <xs:attribute name="User" use="required" type="xs:string"></xs:attribute>
+      <xs:attribute name="Inheritable" type="xs:YesNoType">
+        <xs:annotation>
+          <xs:documentation>Whether the permissions are inheritable. The default is "yes".</xs:documentation>
+        </xs:annotation>
+      </xs:attribute>
       <!-- Common ACLs -->
       <xs:attribute name="Read" type="YesNoType"></xs:attribute>
       <xs:attribute name="Delete" type="YesNoType"></xs:attribute>