diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index e9ea1adb8..987e75803 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,8 @@
+2015-02-27  Corinna Vinschen  <corinna@vinschen.de>
+
+	* security.cc (alloc_sd): For directories, mark inherited ACEs
+	inheritable to better follow POSIX 1003.1e rules.
+
 2015-02-27  Corinna Vinschen  <corinna@vinschen.de>
 
 	* sec_acl.cc (getacl): Add mask even if all group and secondary account
diff --git a/winsup/cygwin/security.cc b/winsup/cygwin/security.cc
index 6dde7d3c8..d8bab20dc 100644
--- a/winsup/cygwin/security.cc
+++ b/winsup/cygwin/security.cc
@@ -792,6 +792,12 @@ alloc_sd (path_conv &pc, uid_t uid, gid_t gid, int attribute,
 		 opening a file's security tab.  Explorer complains if
 		 inheritable ACEs are preceding non-inheritable ACEs. */
 	      ace->Header.AceFlags &= ~INHERITED_ACE;
+	      /* However, if the newly created object is a directory,
+	         it inherits the default ACL from its parent, so mark
+		 all unrelated, inherited ACEs inheritable. */
+	      if (S_ISDIR (attribute))
+		ace->Header.AceFlags |= CONTAINER_INHERIT_ACE
+					| OBJECT_INHERIT_ACE;
 	    }
 	  else if (uid == ILLEGAL_UID && gid == ILLEGAL_UID
 		   && ace->Header.AceType == ACCESS_ALLOWED_ACE_TYPE