From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 47271 invoked by alias); 11 Apr 2015 09:44:19 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 47260 invoked by uid 89); 11 Apr 2015 09:44:19 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-5.4 required=5.0 tests=AWL,BAYES_00,KAM_LAZY_DOMAIN_SECURITY autolearn=no version=3.3.2 X-HELO: calimero.vinschen.de Received: from aquarius.hirmke.de (HELO calimero.vinschen.de) (217.91.18.234) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Sat, 11 Apr 2015 09:44:17 +0000 Received: by calimero.vinschen.de (Postfix, from userid 500) id F3917A80BEE; Sat, 11 Apr 2015 11:44:14 +0200 (CEST) Date: Sat, 11 Apr 2015 09:44:00 -0000 From: Corinna Vinschen To: cygwin@cygwin.com Subject: Re: [TESTERS needed] New POSIX permission handling Message-ID: <20150411094414.GC19111@calimero.vinschen.de> Reply-To: cygwin@cygwin.com Mail-Followup-To: cygwin@cygwin.com References: <20150410100703.GA4401@calimero.vinschen.de> <87lhhzcarc.fsf@Rainer.invalid> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="4ZLFUWh1odzi/v6L" Content-Disposition: inline In-Reply-To: <87lhhzcarc.fsf@Rainer.invalid> User-Agent: Mutt/1.5.23 (2014-03-12) X-SW-Source: 2015-04/txt/msg00194.txt.bz2 --4ZLFUWh1odzi/v6L Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-length: 1946 On Apr 11 10:47, Achim Gratz wrote: > Corinna Vinschen writes: > > - To accommodate Windows default ACLs, the new code ignores SYSTEM and > > Administrators group permissions when computing the MASK/CLASS_OBJ > > permission mask on old ACLs, and it doesn't deny access to SYSTEM and > > Administrators group based on the value of MASK/CLASS_OBJ when > > creating the new ACLs. >=20 > Since you've now opened that can of worms of who is considered "root", > what about "Domain Administrators" or "Power Users", for starters? Nope. The special handling for SYSTEM and Admins will help for the default permission settings on Windows filesystems, and it won't negatively influence the ACL mask handling. > > That means, even if SYSTEM or Administrators have full access to the > > file, the POSIX permssion bits will not reflect that fact. And while > > other users get access denied based on the mask value, SYSTEM and > > Administrators will never get access denied based on the mask. >=20 > If you want to put this to better use in larger settings it would seem > preferrable if it was possible to define a list of users to treat this > way in fstab. Nope, sorry, no configuration for this. Either it's handled without any exception, or for SYSTEM only, or for SYSTEM+Admins. But either way, we're doing it the same way on every system. > Sorry to pile another one on here: Currently it's not possible to use -k > and -b on the same invocation. This works just fine on Linux. I'm not planning to work on this, but as for other parts of Cygwin, I do take patches. > Having the newer getfacl / setfacl from *BSD that deals with NFSv4 ACL > might be worth a shot, ACL handling on Cygwin is POSIX ACL handling. Either that or you set "noacl" and use Windows tools. Corinna --=20 Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Maintainer cygwin AT cygwin DOT com Red Hat --4ZLFUWh1odzi/v6L Content-Type: application/pgp-signature Content-length: 819 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIbBAEBAgAGBQJVKOzuAAoJEPU2Bp2uRE+gfjUP+LMMMPh2U4NTEGgKj8vcDODY 1D74LB0vL3T+XToenjaTSQmNXzTTm1CSAvy03kJ6vyg/n5Ry3VRgvslwAnHji/Nv fpvccXG/smOV0ZerpTqnm1CDcPo2I9jQDPMP3xGRaYSrPquFL4M5DJdbhB9HibBB i7lboIMOugYT9AppcCjlH0sOpR/CsIHiDNOqiX+7Y3U9YFnWdR5MxCAlGggQzAki cg+m9TVXf26724XnLU/MbQ0ldwI+AZWK3xLB0ZZBNabpsIyrBkcwzZhP0ZApeWid O1QDCFs35kZKAY/vQ6WbbRMQBV7FJvJNJNv1Oz+IIzMSfuxUiSoTeOkt8QV7Rj3u bqCRPScXPkmXhVXGrlTeTG+08GaKFsHAs6S6/bxXwk2mSIkCv9ULR7fN/n7GFsRz sfMMEmNuFYp4qE3vqX/xriy+0qMCYe/5qeFofJmoOXUgjuonZ2f4HvlRqcLc6BX1 Arszwp7pwuxZZjtjdKRwe5MBYtK0Uz/j72tBU/ve3JNrGPn68NIrza9TY/+Si4AK hyszJw8ZjKvx1nRqTzz2GfIs1LW9uKjlFEn+HzY7UcmJx6lDvMs9sNnvfLKeZc+a 9s/JUzeSw0/VXhFHe4wkcPzKXj9iSlWGQxumzFwr1x9IwSjAksenfotrj+HTs1X7 6LF3k2JAtQaimlodgnU= =x+KV -----END PGP SIGNATURE----- --4ZLFUWh1odzi/v6L--