From f5fc9e0cf2d8d33fa65ef8be74911da2f5d5c875 Mon Sep 17 00:00:00 2001
From: Thomas Faber <thomas.faber@reactos.org>
Date: Sat, 19 Jan 2019 11:45:33 +0100
Subject: [PATCH] [NTOS:OB] Correctly handle OBJ_PROTECT_CLOSE in
 ObDuplicateObject.

---
 ntoskrnl/ob/obhandle.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/ntoskrnl/ob/obhandle.c b/ntoskrnl/ob/obhandle.c
index 057cdecd7ff..38171d2f16b 100644
--- a/ntoskrnl/ob/obhandle.c
+++ b/ntoskrnl/ob/obhandle.c
@@ -2443,6 +2443,12 @@ ObDuplicateObject(IN PEPROCESS SourceProcess,
         return Status;
     }
 
+    if (NewHandleEntry.ObAttributes & OBJ_PROTECT_CLOSE)
+    {
+        NewHandleEntry.ObAttributes &= ~OBJ_PROTECT_CLOSE;
+        NewHandleEntry.GrantedAccess |= ObpAccessProtectCloseBit;
+    }
+
     /* Now create the handle */
     NewHandle = ExCreateHandle(HandleTable, &NewHandleEntry);
     if (!NewHandle)