diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 993e74c76..de1dcb9fe 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,8 @@
+2010-12-08  Christian Franke  <franke@computer.org>
+
+	* sec_acl.cc (getacl): Set DEF_CLASS_OBJ permissions to 07 instead
+	of 0777.
+
 2010-12-06  Corinna Vinschen  <corinna@vinschen.de>
 
 	* path.cc (path_conv::check): Don't generate ENOENT for non-existant
diff --git a/winsup/cygwin/sec_acl.cc b/winsup/cygwin/sec_acl.cc
index 0c6586bff..24f2468be 100644
--- a/winsup/cygwin/sec_acl.cc
+++ b/winsup/cygwin/sec_acl.cc
@@ -394,7 +394,7 @@ getacl (HANDLE handle, path_conv &pc, int nentries, __aclent32_t *aclbufp)
 	{
 	  lacl[pos].a_type = DEF_CLASS_OBJ;
 	  lacl[pos].a_id = ILLEGAL_GID;
-	  lacl[pos].a_perm = S_IRWXU | S_IRWXG | S_IRWXO;
+	  lacl[pos].a_perm = S_IROTH | S_IWOTH | S_IXOTH;
 	}
     }
   if ((pos = searchace (lacl, MAX_ACL_ENTRIES, 0)) < 0)