Re: [Bug] File permissions across domains

[Achim Gratz <Stromeko@nexgo.de>]

Corinna Vinschen writes:
> This is a bit low on detail.  What does icacls say about this file?  How
> does getfacl report the ACL on a machine in the old domain?  What does
> ls -l report on the file on both machines?  Does an strace on getfacl
> report an error in ACL checking?

There is absolutely no error when stracing getfacl on either machine.
From the machine in the new domain (my account is in group cygwinupload
and access on this share is via ACL only, I can't change ACL):

--8<---------------cut here---------------start------------->8---
/mnt/upload > ll bla
----rwx---+ 1 OLD+gratz OLD+Domain Users 0 Apr 10 15:21 bla
(1011)/mnt/upload > getfacl bla
# file: bla
# owner: OLD+gratz
# group: OLD+Domain Users
user::---
group::---
group:OLD+FileOperators:rwx
group:OLD+cygwinupload:rwx
mask:rwx
other:---

(1012)/mnt/upload > `cygpath -S`/icacls bla
bla OLD\FileOperators:(I)(F)
    OLD\cygwinupload:(I)(M)

Successfully processed 1 files; Failed processing 0 files
--8<---------------cut here---------------end--------------->8---

The same thing on a machine in the old domain:

--8<---------------cut here---------------start------------->8---
(1007)/mnt/upload > ll bla
-rwxrwx---+ 1 gratz Domain Users 0 Apr 10 15:21 bla
(1008)/mnt/upload > getfacl bla
# file: bla
# owner: gratz
# group: Domain Users
user::rwx
group::---
group:FileOperators:rwx
group:cygwinupload:rwx
mask:rwx
other:---

(1009)/mnt/upload > `cygpath -S`/icacls bla
bla OLD\FileOperators:(I)(F)
    OLD\cygwinupload:(I)(M)

Successfully processed 1 files; Failed processing 0 files
--8<---------------cut here---------------end--------------->8---

Checking how Cygwin reads my own account results in exactly the same SID
on both machines as it should, but of course Cygwin translates that to
different uid / gid values due to the presence of the domain prefix when
I'm logged into the machine in the new domain:

OLD+gratz:*:2147559089:2147484161:U-OLD\gratz,S-1-5-21-20…441:/home/gratz:/bin/bash
gratz:*:1124017:1049089:U-OLD\gratz,S-1-5-21-20…441:/home/gratz:/bin/bash

I have not yet tried to force the account back to a prefix-less
interpretation via /etc/passwd (I had to do that in my home network
without a DC to solve a similar problem, but I'd like to avoid that
here).


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

SD adaptations for KORG EX-800 and Poly-800MkII V0.9:
http://Synth.Stromeko.net/Downloads.html#KorgSDada

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple