Re: [Bug] setup regression #2

[Corinna Vinschen <corinna-cygwin@cygwin.com>]

On Nov 20 20:05, Achim Gratz wrote:
> Jon Turney writes:
> > I believe that the intent of the code in setup is that there should
> > only be two modes:
> >
> > USER: install "for me", with the users primary group
> 
> As I understand it, the intention here was that the user can have a
> "single user installation" in a place that they have access to (say,
> their home directory) while they have no permission in one of the usual
> places.  In a setup where that place is a certain type of share the user
> will not be able to change the group the files are owned by anyway
> (standard NetApp CIFS shares are set up this way) and it may not be the
> users primary group.
> 
> > SYSTEM: install "for everyone", with the administrators primary group
> > (only permitted if you are an administrator)
> 
> I don't see why the fact the installation is meant to be used by
> multiple users means that the install must be owned by group
> Administrators.  I'm not sure this is a good idea on Windows anyway, at
> least when you don't put extra (inheritable) DACL on the install
> folder.

The idea is that the installation tree has POSIXy permissions and
administrative users have the right to change stuff.  The administrators
group is part of the user's token if the process has been started
elevated, so, to me, this looks like a natural choice.

The other advantage is that the administrators group has a fixed SID on
all systems, while other groups depend on the environment.  That goes
for the local group "None" just as well as for the "Domain Users"
group, etc.

I'm not adamant about this, it was just what was looking like being the
right thing to do at the time.  Especially I was not hot to make the
permission set more complicated than necessary for a POSIX-like system.


Corinna