From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 28147 invoked by alias); 15 Dec 2014 11:35:46 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 28132 invoked by uid 89); 15 Dec 2014 11:35:46 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-5.9 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.3.2 X-HELO: calimero.vinschen.de Received: from aquarius.hirmke.de (HELO calimero.vinschen.de) (217.91.18.234) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Mon, 15 Dec 2014 11:35:44 +0000 Received: by calimero.vinschen.de (Postfix, from userid 500) id 55E7F8E1404; Mon, 15 Dec 2014 12:35:42 +0100 (CET) Date: Mon, 15 Dec 2014 11:35:00 -0000 From: Corinna Vinschen To: cygwin@cygwin.com Subject: Re: TEST RELEASE: Cygwin 1.7.34-002 Message-ID: <20141215113542.GE11307@calimero.vinschen.de> Reply-To: cygwin@cygwin.com Mail-Followup-To: cygwin@cygwin.com References: <20141206194943.GD3810@calimero.vinschen.de> <548AFD43.1040306@cornell.edu> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="maH1Gajj2nflutpK" Content-Disposition: inline In-Reply-To: <548AFD43.1040306@cornell.edu> User-Agent: Mutt/1.5.23 (2014-03-12) X-SW-Source: 2014-12/txt/msg00219.txt.bz2 --maH1Gajj2nflutpK Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-length: 3234 On Dec 12 09:35, Ken Brown wrote: > On 12/12/2014 8:49 AM, Michael DePaulo wrote: > >On Sat, Dec 6, 2014 at 2:49 PM, Corinna Vinschen > > wrote: > >>I finally released another TEST version of the next upcoming Cygwin > >>release. The version number is 1.7.34-002. > > > >I *think* I am experiencing a very bad regression. > > > >These are the Windows permissions on my ~/.ssh/id_rsa file: > >C:\cygwin\home\mike\.ssh>icacls id_rsa > >id_rsa NT AUTHORITY\SYSTEM:(F) > > DEPAULO\mike:(R,W,D,WDAC,WO) > >[...] > >$ uname -a > >CYGWIN_NT-6.3-WOW64 executor 1.7.34(0.282/5/3) 2014-12-06 18:03 i686 Cyg= win > > > >mike@executor ~ > >$ ssh galactica > >@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > >@ WARNING: UNPROTECTED PRIVATE KEY FILE! @ > >@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > >Permissions 0670 for '/home/mike/.ssh/id_rsa' are too open. > >It is recommended that your private key files are NOT accessible by othe= rs. > >This private key will be ignored. > >key_load_private_type: bad permissions > >[...] > >mike@executor ~/.ssh > >$ ls -latr id_rsa > >-rw-rwx---+ 1 mike Domain Users 1743 Dec 7 2013 id_rsa >=20 > This isn't a regression. It's a deliberate change, so that Cygwin now ta= kes > ACLs into account when calculating permissions. The simplest fix is to u= se > the new feature of setfacl to remove the unwanted permissions. From the > release announcement: >=20 > >- Add -b/--remove-all option to setfacl to reduce the ACL to only the > > entries representing POSIX permission bits. >=20 > Ken What he says. Here are the important snippets from the POSIX ACL Linux man page (for instance http://linux.die.net/man/5/acl), which was never before implemented in Cygwin, but which is with the test release (and thus the upcoming release): An ACL that contains entries of ACL_USER or ACL_GROUP tag types must contain exactly one entry of the ACL_MASK tag type. Windows doesn't support MASK entries. But POSIX requires a MASK entry if a supplementary user or group has an ACL entry, thus Cygwin emulates the entry. The ACL_MASK entry denotes the maximum access rights that can be granted by entries of type ACL_USER, ACL_GROUP_OBJ, or ACL_GROUP.=20 So the emulated MASK entry is the or'ed mask of all permissions granted to the primary group and all supplementary users and groups. There is a correspondence between the file owner, group, and other permissions and specific ACL entries: [...] If the ACL has an ACL_MASK entry, the group permissions correspond to the permissions of the ACL_MASK entry. So, the group permissions don't simply reflect the permissions of the primary group, but the sum of permissions of the primary group and all supplementary users and groups in the ACL. It's unfortunate that this may break more installations, but it's also a security improvment. The group permissions reflect the fact that the permissions granted to your ssh key are too open. Fortunately the new -b option to setfacl allows a quick fix. Corinna --=20 Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Maintainer cygwin AT cygwin DOT com Red Hat --maH1Gajj2nflutpK Content-Type: application/pgp-signature Content-length: 819 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJUjseOAAoJEPU2Bp2uRE+gG4kP/2l6SMjvZYAztZ8NRAEzqzlv 3N9sKlvapVieY0UbZKYbdiSgjRlPN2GrJoXwluxqQelOGnyUGyJ7aYOoRtlg/SZf Sc7wn8hHVOX4nv7My+HfJ3tyJLc7Y97+yssyAW7h/Uoq0VncDafAZjNnBY99H8Bt bJ9XbCfcfmDvCW4ZOzpDRXp7bYIuQ+BZoum1+DlNCS6GIpUyTqejwOcqGkf5QZAR zTyKRShISfidswTjRQQ/GWnH177s+alYc6A/B35f1QnRuYQlaYy0estTy0o1JqEe 9A9CGMsiEbCmnSUE1KR5dqgUdHjC3UhxFbvpL+Jytk5F74WvVlQUyyOY15NjqwxL M5Pb97v8Dwt+YU2rjR1B1VmyUjpXsTm0FzKo3zMZh2UMnxKuaxmrEPHd5LWjbNEb +A3EwhcYRgRa2UVfZjcShFQyslXHEMYqiKCqrsLg9yW9B0ieZSZqG9el2+n9eYty 2VzcIDlZOtwyrPvz5xybvzvhqe0VD48BB6n2r0616iqjJA2qkD7qpS7flJq9UuDc /8Yt2wr7t+kCcbkKy65OWvSWgH7pPWXPU0lwtxTQVCXMCqr4C9CGZeCkiQerrUtm QeYhyg1LCLEHO+DQNae5SyJQdMkriMkEpviLw91ZPpc9ouuBmW9KO5sJOzz4kKEb SDaFp0/vQFaJ/ffaGc1T =VB5m -----END PGP SIGNATURE----- --maH1Gajj2nflutpK--