From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from forward101o.mail.yandex.net (forward101o.mail.yandex.net [IPv6:2a02:6b8:0:1a2d::601]) by sourceware.org (Postfix) with ESMTPS id DBF3E385E006 for ; Fri, 27 Mar 2020 10:05:06 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org DBF3E385E006 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=yandex.ru Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=anrdaemon@yandex.ru Received: from forward103q.mail.yandex.net (forward103q.mail.yandex.net [IPv6:2a02:6b8:c0e:50:0:640:b21c:d009]) by forward101o.mail.yandex.net (Yandex) with ESMTP id 3F5BD3C01C93; Fri, 27 Mar 2020 13:05:02 +0300 (MSK) Received: from mxback2q.mail.yandex.net (mxback2q.mail.yandex.net [IPv6:2a02:6b8:c0e:40:0:640:9c8c:4946]) by forward103q.mail.yandex.net (Yandex) with ESMTP id 3B5D461E0005; Fri, 27 Mar 2020 13:05:02 +0300 (MSK) Received: from vla3-4c649d03f525.qloud-c.yandex.net (vla3-4c649d03f525.qloud-c.yandex.net [2a02:6b8:c15:2584:0:640:4c64:9d03]) by mxback2q.mail.yandex.net (mxback/Yandex) with ESMTP id Yfi3tV4Spc-52JaJSD5; Fri, 27 Mar 2020 13:05:02 +0300 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1585303502; bh=nhQY/YZIz/ZzGzlF0FtJDro8yocxqPGW7r4raOPlmVs=; h=In-Reply-To:Subject:To:Reply-To:From:Message-ID:References:Date; b=sWulnELse+PSp6zBJkmitwIaO/r3FFAlnzXdij3Gjh2sJDAKUAq/ag1g2UFx74Sec hAtEV426t+3yLV4dFkFe3MWlxIStDM4JS/pUhmYoYtgwxKzxrB+2hIdJj7MfiBCXKn w4qmtXbd06dqSeYlq4P5gKXe+l51tGRQAV485HYU= Authentication-Results: mxback2q.mail.yandex.net; dkim=pass header.i=@yandex.ru Received: by vla3-4c649d03f525.qloud-c.yandex.net (smtp/Yandex) with ESMTPSA id NXIbMcCYl1-51bKwWsL; Fri, 27 Mar 2020 13:05:01 +0300 (using TLSv1 with cipher ECDHE-RSA-AES128-SHA (128/128 bits)) (Client certificate not present) Received: from [192.168.1.10] (HELO daemon2.darkdragon.lan) by daemon2 (Office Mail Server 0.8.12 build 08053101) with SMTP; Fri, 27 Mar 2020 09:51:55 -0000 Date: Fri, 27 Mar 2020 12:51:55 +0300 From: Andrey Repin X-Mailer: The Bat! (v6.8.8) Home Reply-To: cygwin@cygwin.com X-Priority: 3 (Normal) Message-ID: <459837604.20200327125155@yandex.ru> To: Kacper Michajlow , cygwin@cygwin.com Subject: Re: ACL: Why SYSTEM doesn't have full access set on newly created files? In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-1.1 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, KAM_THEBAT, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=no autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: cygwin@cygwin.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: General Cygwin discussions and problem reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Mar 2020 10:05:09 -0000 Greetings, Kacper Michajlow! > I know that Cygwin tries to emulate UNIX permissions using ACL. But I don't > understand why SYSTEM doesn't have Full Control allowed or even modify. > Shouldn't generally SYSTEM have access to everything? This is because basic POSIX permissiosn are that -stupid +limited. And because in Windows there's no inherent super-user. Even SYSTEM do not have powers to go against set permissions. POSIX permissions in Cygwin are emulated using Windows ACL. Part of the answer can be found in https://cygwin.com/faq.html#faq.using.ssh-pubkey-stops-working The rest is in https://cygwin.com/cygwin-ug-net/ntsec.html > I have cloned git repository of UWP application, and deployment fails in VS > with error: > "DEP0700: Registration of the app failed. [0x80070005] Deployment Register > operation with target volume F: on Package ... from: (AppxManifest.xml) > failed with error 0x80070005." > It is easily fixable by adding Full Control for SYSTEM on all files, but > that wasn't my first idea, so it took some time :) Long story short, it > fails and might be not obvious for the user why, at the first glance. It is easily fixable by mounting directories outside Cygwin tree with "noacl" flag. It is even required to do so, if you expect interoperation between Cygwin and native tools. > Also when accessing ACL from Explorer it throws: > "The permissions on are incorrectly ordered, which may cause > some entries to be ineffective." > And forces me to reorder them if I want to edit. Don't do that on Cygwin directory tree, you break Cygwin doing this. > That said, I have three questions: > 1. Could Cygwin by default give SYSTEM full control? If not, why? Answered multiple time in the last 20 years. Read the docs. > 2. Could Cygwin put ACL in order, so Windows doesn't complain about it? They are in correct order. Just not canonical order, which Explorer only supports. > 3. Do we need "NULL SID" entry? Yes. > Documentation: https://cygwin.com/docs.html -- With best regards, Andrey Repin Friday, March 27, 2020 12:31:49 Sorry for my terrible english...