From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 122831 invoked by alias); 12 Apr 2018 19:16:41 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 122816 invoked by uid 89); 12 Apr 2018 19:16:40 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-2.0 required=5.0 tests=AWL,BAYES_00,SPF_PASS autolearn=ham version=3.3.2 spammy=Hx-languages-length:2588, sheer, rights, Hx-spam-relays-external:ESMTPA X-HELO: mx009.vodafonemail.xion.oxcs.net Received: from Unknown (HELO mx009.vodafonemail.xion.oxcs.net) (153.92.174.39) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 12 Apr 2018 19:16:38 +0000 Received: from vsmx002.vodafonemail.xion.oxcs.net (unknown [192.168.75.192]) by mta-6-out.mta.xion.oxcs.net (Postfix) with ESMTP id 31C9ED9AED5 for ; Thu, 12 Apr 2018 19:16:30 +0000 (UTC) Received: from Gertrud (unknown [91.47.59.44]) by mta-6-out.mta.xion.oxcs.net (Postfix) with ESMTPA id 0DB27199C34 for ; Thu, 12 Apr 2018 19:16:27 +0000 (UTC) From: Achim Gratz To: cygwin@cygwin.com Subject: Re: [Bug] File permissions across domains References: <874lkjt3dw.fsf@Rainer.invalid> <20180411070312.GK29703@calimero.vinschen.de> <20180411093443.GM29703@calimero.vinschen.de> <87r2nlwtln.fsf@Rainer.invalid> <20180412073805.GS29703@calimero.vinschen.de> Date: Thu, 12 Apr 2018 19:16:00 -0000 In-Reply-To: <20180412073805.GS29703@calimero.vinschen.de> (Corinna Vinschen's message of "Thu, 12 Apr 2018 09:38:05 +0200") Message-ID: <87bmeo8cc7.fsf@Rainer.invalid> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-VADE-STATUS: LEGIT X-SW-Source: 2018-04/txt/msg00139.txt.bz2 Corinna Vinschen writes: > I inspected the source code which handles this kind of thing. What it > does is to ask Windows for permissions of SID X on file Y, using AuthZ. That seems to be working correctly. For all old domain SID I've looked at, they've been prefixed by 0x7FFF0000 when seen by the new domain machine, so both the SID and conversion of uid/gid works correctly. If it didn't I'd not be able to see my homedir and other stuff too. > See sec_acl.cc, line 1127ff. This calls a function > authz_get_user_attribute which in turn calls a method > authz_ctx::get_user_attribute, sec_helper.cc, line 811ff. > > This method checks if the owner of the file is the current user. Given > this test is done using SIDs, not Cygwin uids, this should be you, *iff* > you're logged in as the same user on both machines at the time you > created the above output. This in turn should create the Authz context > for the current user from the current process token and the subsequent > AuthzAccessCheck should give the same result on both machines. I've looked briefly at the source code, but I don't really see what's going on. While poking around, I noticed that the error/bug is far more specific than I thought: The merging of the access rights bestowed by access groups is working correctly if the file is not owned by the current user, but fails if it's owned by the current user. I have a second account that I must use for doing anything administrative and it's also in the old domain. > One reason could be that you're member of OLD+cygwinupload only on the > old machine, while this group is not in your current process token when > logged in on your NEW machine. You should check your token. In terms > of group membership an `id' call should suffice. But there may be > other differences in the token. That all seems to be correct as far as I can tell. > If that's not the problem, you will have to debug this, because > only you have access to this environment. Given the sheer size of the function I'd appreciate if you could point out on which line the decision is made whether the file is owned by me or not. It seems that I should step through from that point on to see where it makes the (wrong) decision to not merge access rights via groups. > It wouldn't change anything since the access check is performed on > SIDs, not uids. True. Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ Samples for the Waldorf Blofeld: http://Synth.Stromeko.net/Downloads.html#BlofeldSamplesExtra -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple