I can't comment on the Tk code, but as far as the permissions are concerned, I think you are close to what you want but maybe getting a little mixed up about the myriad constants exported from Win32:Perms and which ones can be combined with which.

The best documentation beside Dave Roth's books, is the Win32::Perms homepage. It's the only consise description of this stuff I've found. It well worth reading top-to-bottom, (twice:), rather than trying to home in on just the bit you think you need, as I normally do. It greatly clarified the greater picture for me.

If, after you have read that page, you have a specific question about the Win32::Perms (as opposed to the Tk stuff which is just clouding the picture), ask again and I (and other monks no doubt) will try and help further.

BTW. As you are probably aware, BlueBlazerRegular's stuff above about using || instead of | and quoting these constants is wrong. He obviously isn't aware that CONTAINER_INHERIT_ACE, OBJECT_INHERIT_ACE and the rest are bit-wise encoded manifest constants and that you do want to bit-wise-or them together.