Re: TEST RELEASE: Cygwin 1.7.34-002

[Corinna Vinschen <corinna-cygwin@cygwin.com>]

[-- Attachment #1: Type: text/plain, Size: 3297 bytes --]

On Dec 12 09:35, Ken Brown wrote:
> On 12/12/2014 8:49 AM, Michael DePaulo wrote:
> >On Sat, Dec 6, 2014 at 2:49 PM, Corinna Vinschen
> ><corinna-cygwin@cygwin.com> wrote:
> >>I finally released another TEST version of the next upcoming Cygwin
> >>release.  The version number is 1.7.34-002.
> >
> >I *think* I am experiencing a very bad regression.
> >
> >These are the Windows permissions on my ~/.ssh/id_rsa file:
> >C:\cygwin\home\mike\.ssh>icacls id_rsa
> >id_rsa NT AUTHORITY\SYSTEM:(F)
> >        DEPAULO\mike:(R,W,D,WDAC,WO)
> >[...]
> >$ uname -a
> >CYGWIN_NT-6.3-WOW64 executor 1.7.34(0.282/5/3) 2014-12-06 18:03 i686 Cygwin
> >
> >mike@executor ~
> >$ ssh galactica
> >@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> >@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
> >@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> >Permissions 0670 for '/home/mike/.ssh/id_rsa' are too open.
> >It is recommended that your private key files are NOT accessible by others.
> >This private key will be ignored.
> >key_load_private_type: bad permissions
> >[...]
> >mike@executor ~/.ssh
> >$ ls -latr id_rsa
> >-rw-rwx---+ 1 mike Domain Users 1743 Dec  7  2013 id_rsa
> 
> This isn't a regression.  It's a deliberate change, so that Cygwin now takes
> ACLs into account when calculating permissions.  The simplest fix is to use
> the new feature of setfacl to remove the unwanted permissions.  From the
> release announcement:
> 
> >- Add -b/--remove-all option to setfacl to reduce the ACL to only the
> >  entries representing POSIX permission bits.
> 
> Ken

What he says.  Here are the important snippets from the POSIX ACL Linux
man page (for instance http://linux.die.net/man/5/acl), which was never
before implemented in Cygwin, but which is with the test release (and
thus the upcoming release):

  An ACL that contains entries of ACL_USER or ACL_GROUP tag types must
  contain exactly one entry of the ACL_MASK tag type.

Windows doesn't support MASK entries.  But POSIX requires a MASK entry
if a supplementary user or group has an ACL entry, thus Cygwin emulates
the entry.

  The ACL_MASK entry denotes the maximum access rights that can be
  granted by entries of type ACL_USER, ACL_GROUP_OBJ, or ACL_GROUP. 

So the emulated MASK entry is the or'ed mask of all permissions granted
to the primary group and all supplementary users and groups.

  There is a correspondence between the file owner, group, and other
  permissions and specific ACL entries:
  [...]
  If the ACL has an ACL_MASK entry, the group permissions correspond to
  the permissions of the ACL_MASK entry.

So, the group permissions don't simply reflect the permissions of the
primary group, but the sum of permissions of the primary group and all
supplementary users and groups in the ACL.

It's unfortunate that this may break more installations, but it's also a
security improvment.  The group permissions reflect the fact that the
permissions granted to your ssh key are too open.  Fortunately the new
-b option to setfacl allows a quick fix.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

[-- Attachment #2: Type: application/pgp-signature, Size: 819 bytes --]