1. In a computing environment comprising a processing unit and memory, a computer-implemented method for propagating access control information in a relational file system, the method comprising: triggering propagation of access control information when at least one security descriptor of a first item of a plurality of items in an item hierarchy is changed, wherein each of the plurality of items is one of a generic container item that contains zero or more items, a file backed item that is a leaf node in the item hierarchy, or a compound item that stores at least one container and at least one item in the container as a single unit of consistency, wherein each of the plurality of items that is not a root item of the item hierarchy has exactly one parent item, and wherein at least one of the plurality of items is a compound item; propagating, synchronously and as a single transaction, an access control list (ACL) corresponding to the first item to a second item that is a child of the first item in a sub tree of items below the first item in the item hierarchy, the ACL comprising one or more access control entry (ACE), each ACE comprising an access right and at least one inheritance flag that is one of “container inherit,” “object inherit” or “inherit only,” wherein there is at least one ACE with a “container inherit” inheritance flag and at least one ACE with an “object inherit” inheritance flag, and wherein propagating the ACL to the second item based, at least in part, upon the ACL of the first item, an ACL of the second item and an item type of the second item, the propagation comprising: identifying the item type the second item as one of a generic container, a file backed item, or a compound item, as well as identifying whether or not the second item is protected, and when the second item is not protected and is a generic container, propagating to the second item each “container inherit” flagged ACE as “container inherit,” and propagating to the second item each “object inherit” flagged ACE as “object inherit” and “inherit only”; when the second item is not protected and is a file backed item and therefore a leaf node, propagating to the second item, with the “object inherit” flag removed, each “object inherit” flagged ACE, and not propagating to the second item any “container inherit” flagged ACE; when the second item is not protected and is a compound item, treating the second item as a non-container item by propagating to the second item each “object inherit” flagged ACE as “object inherent,” thus allowing propagation of the “object inherit” flagged ACE through the compound item, and propagating to the second item each “container inherit” flagged ACE as “container inherit” and “inherit only”; and when the second item is protected, not propagating to the second item an ACE, thereby preventing propagation of access control information to the second item and any item in a sub tree of items below the second item, regardless of permissions a user may hold in the sub tree of items below the second item; and storing the propagated access control list for the second item.