From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 124076 invoked by alias); 13 Aug 2015 17:48:12 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 124040 invoked by uid 89); 13 Aug 2015 17:48:11 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-2.0 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2 X-HELO: mail-in-02.arcor-online.net Received: from mail-in-02.arcor-online.net (HELO mail-in-02.arcor-online.net) (151.189.21.42) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with (CAMELLIA256-SHA encrypted) ESMTPS; Thu, 13 Aug 2015 17:48:07 +0000 Received: from mail-in-20-z2.arcor-online.net (mail-in-20-z2.arcor-online.net [151.189.8.85]) by mx.arcor.de (Postfix) with ESMTP id 3msb284Wc1z5yJW for ; Thu, 13 Aug 2015 19:47:12 +0200 (CEST) Received: from mail-in-14.arcor-online.net (mail-in-14.arcor-online.net [151.189.21.54]) by mail-in-20-z2.arcor-online.net (Postfix) with ESMTP id 987706FAF6A for ; Thu, 13 Aug 2015 19:47:12 +0200 (CEST) X-DKIM: Sendmail DKIM Filter v2.8.2 mail-in-14.arcor-online.net 3msb283YTLz90HB Received: from Gertrud (p54B465D0.dip0.t-ipconnect.de [84.180.101.208]) (Authenticated sender: stromeko@arcor.de) by mail-in-14.arcor-online.net (Postfix) with ESMTPSA id 3msb283YTLz90HB for ; Thu, 13 Aug 2015 19:47:12 +0200 (CEST) From: Achim Gratz To: cygwin@cygwin.com Subject: Re: Shares with strange ACL settings References: <20150812152601.GL13029@calimero.vinschen.de> <20150812155817.GN13029@calimero.vinschen.de> <878u9g9y6b.fsf@Rainer.invalid> <20150812183220.GO13029@calimero.vinschen.de> <87vbck8h92.fsf@Rainer.invalid> <20150813163302.GB28349@calimero.vinschen.de> Date: Thu, 13 Aug 2015 17:48:00 -0000 In-Reply-To: <20150813163302.GB28349@calimero.vinschen.de> (Corinna Vinschen's message of "Thu, 13 Aug 2015 18:33:02 +0200") Message-ID: <87egj7w06b.fsf@Rainer.invalid> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.0.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-SW-Source: 2015-08/txt/msg00195.txt.bz2 Corinna Vinschen writes: > This puzzles me a bit. As example you gave something like > > ----rwx---+ gratz Domain Users [...] foo > > Given the code in recent Cygwin versions, this shouldn't happen if the > user gratz is member of the Domain Users group. The current code > doesn't test all groups in the ACL, only the primary group, but that's > sufficient in most cases. I've detailed the setup in an earlier post (with getfacl and icacls output) that I can't dig out shortly, but the setup is, in a nutshell: The share access is purely governed by two access groups, one that gives you the right to read and another one that lets you create and change things. You'll be in one or both of these groups in AD. All ACL are inherited from the root of the share down and the right to change the DACL (and thus remove that inheritance) is explicitly forbidden for anybody. The actual setup is a bit more complicated, with additional groups that ensure that share administrators can do what they need to do and that the backup can actually be done, etc.pp. > So this could only happen if you modify the permissions of windows files > using Cygwin tools and Cygwin helpfully gernerates a DENY ACE for the > owner. No, the owner just never gets the full access it would need to do this. For a while they didn't even let you look at the DACL, but at least that part of the silliness has been fixed. > I'm just not exactly sure about the way to go to get these permissions > in a non-artificial scenario. But I can reproduce it like this: > > - The file xxx has a primary group different from the group which has > permissions, e.g.: > > owner: foo > pgroup: foo_group > > acl: 1 entry > bar_group: full control > > - ls -l xxx > ----rwx---+ 1 foo foo_group 68565 Aug 10 10:37 xxx > > - $ chmod g-w xxx The chmod, if you try to run it, never succeeds. That's the crux of this setup, anything will always have just rwx for the group via ACL and you can't change that. > So, what's going on here and how do we really fix it? It *might* be > prudent to drop any efforts to create DENY ACEs to reflect the POSIX > perms. That results in the documented permission gap between POSIX and > Windows permissions, though. There's just no way to express all possible > POSIX permissions using Windows ALLOW ACEs only. There aren't any deny ACL, you just don't get the right to play with the permissions to start with. FOr Windows it doesn't matter that the owner hasn't got any access rights as long as she's in a group that has. POSIX doesn't even look at the group/ACL if it the owner bits are cleared. Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ Waldorf MIDI Implementation & additional documentation: http://Synth.Stromeko.net/Downloads.html#WaldorfDocs -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple