Repairing permissions after windows reinstall

Repairing permissions after windows reinstall

[Henry S. Thompson]

Good news: My cygwin file tree survived a Windows (10) reinstall
Not-so-good news: I have a new SID, so not only do I not own those files
any more (that's easily fixed), but I don't have the permissions I
should, because they are now held by some miscellaneous old SID.

In fact I see _two_ raw SIDs when I look at the security tab for any
directory in the old cygwin tree: one has Full control, and the other
just Read & execute.

I presume the first is the old me, what's the second?

Can this be easily fixed, i.e. put me back where I used to be?

Thanks,

ht

[Note, I have read

  http://superuser.com/questions/439675/how-to-bind-old-users-sid-to-new-user-to-remain-ntfs-file-ownership-and-permiss

which was the only thing I could find by searching, but I wondered if
there was a Cygwin way. . .]
-- 
       Henry S. Thompson, School of Informatics, University of Edinburgh
      10 Crichton Street, Edinburgh EH8 9AB, SCOTLAND -- (44) 131 650-4440
                Fax: (44) 131 650-4587, e-mail: ht@inf.ed.ac.uk
                       URL: http://www.ltg.ed.ac.uk/~ht/
 [mail from me _always_ has a .sig like this -- mail without it is forged spam]

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Repairing permissions after windows reinstall

[Corinna Vinschen]

[-- Attachment #1: Type: text/plain, Size: 1221 bytes --]

On Jun 28 11:04, Henry S. Thompson wrote:
> Good news: My cygwin file tree survived a Windows (10) reinstall
> Not-so-good news: I have a new SID, so not only do I not own those files
> any more (that's easily fixed), but I don't have the permissions I
> should, because they are now held by some miscellaneous old SID.
> 
> In fact I see _two_ raw SIDs when I look at the security tab for any
> directory in the old cygwin tree: one has Full control, and the other
> just Read & execute.
> 
> I presume the first is the old me, what's the second?
> 
> Can this be easily fixed, i.e. put me back where I used to be?

Off the top of my head, what you could do is this:

- Generate an /etc/passwd entry for your old user SID by hand.
  Make sure to use an arbitrary weird UID like 98765.

- Exit and start an elevated shell.

- find . -uid 98765 | xargs chown <newuser name or UID>

Analog for the group if necessary.

Alternativaly there are tools in the wild to change the SID of a file.
But those *might* break Cygwin POSIX ACLs.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: Repairing permissions after windows reinstall

[Henry S. Thompson]

Corinna Vinschen writes:

> On Jun 28 11:04, Henry S. Thompson wrote:
>> Good news: My cygwin file tree survived a Windows (10) reinstall
>> Not-so-good news: I have a new SID, so not only do I not own those files
>> any more (that's easily fixed), but I don't have the permissions I
>> should, because they are now held by some miscellaneous old SID.
>> 
>> In fact I see _two_ raw SIDs when I look at the security tab for any
>> directory in the old cygwin tree: one has Full control, and the other
>> just Read & execute.
>> 
>> I presume the first is the old me, what's the second?
>> 
>> Can this be easily fixed, i.e. put me back where I used to be?
>
> Off the top of my head, what you could do is this:
>
> - Generate an /etc/passwd entry for your old user SID by hand.
>   Make sure to use an arbitrary weird UID like 98765.
>
> - Exit and start an elevated shell.
>
> - find . -uid 98765 | xargs chown <newuser name or UID>
>
> Analog for the group if necessary.

Thanks, but ownership is not the problem.  The problem is that the ACLs
(as reported by Windows itself via the Security tab) don't allow the new
me (or OWNER) the necessary (or indeed any) permissions, those are given
to the old SID.

Here's what shows up for /bin:

Advanced Security Settings for bin
Name: C\C64\bin
Owner: ht (LUTHER\ht) ' Change
...
Permission entries:
Type Principal                         Access       lnherite... Applies to
---------------------------------------------------------------------------
Allow S-1-5-21-32...-1001 Full control None This folder only
Allow S-1-5-21-32...-513  Read & ex... None This folder only
Allow Everyone            Read & ex... None This folder, subfolders and files
Allow CREATOR OWNER       Full control None Subfolders and files only
Allow CREATOR GROUP       Read & ex... None Subfolders and files only

ht
-- 
       Henry S. Thompson, School of Informatics, University of Edinburgh
      10 Crichton Street, Edinburgh EH8 9AB, SCOTLAND -- (44) 131 650-4440
                Fax: (44) 131 650-4587, e-mail: ht@inf.ed.ac.uk
                       URL: http://www.ltg.ed.ac.uk/~ht/
 [mail from me _always_ has a .sig like this -- mail without it is forged spam]

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Repairing permissions after windows reinstall

[Corinna Vinschen]

[-- Attachment #1: Type: text/plain, Size: 1777 bytes --]

On Jun 28 12:08, Henry S. Thompson wrote:
> Corinna Vinschen writes:
> 
> > On Jun 28 11:04, Henry S. Thompson wrote:
> >> Good news: My cygwin file tree survived a Windows (10) reinstall
> >> Not-so-good news: I have a new SID, so not only do I not own those files
> >> any more (that's easily fixed), but I don't have the permissions I
> >> should, because they are now held by some miscellaneous old SID.
> >> 
> >> In fact I see _two_ raw SIDs when I look at the security tab for any
> >> directory in the old cygwin tree: one has Full control, and the other
> >> just Read & execute.
> >> 
> >> I presume the first is the old me, what's the second?
> >> 
> >> Can this be easily fixed, i.e. put me back where I used to be?
> >
> > Off the top of my head, what you could do is this:
> >
> > - Generate an /etc/passwd entry for your old user SID by hand.
> >   Make sure to use an arbitrary weird UID like 98765.
> >
> > - Exit and start an elevated shell.
> >
> > - find . -uid 98765 | xargs chown <newuser name or UID>
> >
> > Analog for the group if necessary.
> 
> Thanks, but ownership is not the problem.  The problem is that the ACLs
> (as reported by Windows itself via the Security tab) don't allow the new
> me (or OWNER) the necessary (or indeed any) permissions, those are given
> to the old SID.

Ok, hmm.  In that case you could check the current permissions
with getfacl and then call setfacl with a modified ACL giving the
owner the permissions of user 98765 while at the same time remove 
the entry for user 98765.  It's just a bit of shell script hacking.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: Repairing permissions after windows reinstall

[Achim Gratz]

Corinna Vinschen <corinna-cygwin <at> cygwin.com> writes:
> - find . -uid 98765 | xargs chown <newuser name or UID>

This would run into /proc, which can create a lot of damage depending on
what you do with the files.  The find should either be started from
/cygdrive/c/wherever_cygwin_is_installed and/or use the '-xdev' option.  In
 order to process files with spaces in their names correctly, you'd also
need to use '-print0' on the find and '-0' for xargs.

That still doesn't fix inherited ACL I think, so you'd need something else
to fix those (preferably before doing the chown).


Regards,
Achim.


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Repairing permissions after windows reinstall

[Andrey Repin]

Greetings, Henry S. Thompson!

> Good news: My cygwin file tree survived a Windows (10) reinstall
> Not-so-good news: I have a new SID, so not only do I not own those files
> any more (that's easily fixed), but I don't have the permissions I
> should, because they are now held by some miscellaneous old SID.

So, what? Go to top directory properties, Advanced, Owner tab, Change, and
change the owner to what is desired.

> In fact I see _two_ raw SIDs when I look at the security tab for any
> directory in the old cygwin tree: one has Full control, and the other
> just Read & execute.

> I presume the first is the old me, what's the second?

If you write these SID's it would be easier to tell.

> Can this be easily fixed, i.e. put me back where I used to be?

As Corinna said, this can be fixed, you just have to fake a valid UID for old
user to jumpstart the process.
Obviously, you would need to run the script as administrator account to work
on the permissions changes.


-- 
With best regards,
Andrey Repin
Friday, July 1, 2016 08:55:58

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Repairing permissions after windows reinstall

[Henry S. Thompson]

Andrey Repin writes:

> Greetings, Henry S. Thompson!
>
>> Good news: My cygwin file tree survived a Windows (10) reinstall
>> Not-so-good news: I have a new SID, so not only do I not own those files
>> any more (that's easily fixed), but I don't have the permissions I
>> should, because they are now held by some miscellaneous old SID.
>
> So, what? Go to top directory properties, Advanced, Owner tab, Change, and
> change the owner to what is desired.

Much to glib an answer.  Changing the owner is the _last_ thing you want
to do after (programmatically) changing a bunch of ACLs.

>> In fact I see _two_ raw SIDs when I look at the security tab for any
>> directory in the old cygwin tree: one has Full control, and the other
>> just Read & execute.
>
>> I presume the first is the old me, what's the second?

> If you write these SID's it would be easier to tell.

...-513 - Domain User, it turns out.

>> Can this be easily fixed, i.e. put me back where I used to be?
>
> As Corinna said, this can be fixed, you just have to fake a valid UID for old
> user to jumpstart the process.
> Obviously, you would need to run the script as administrator account to work
> on the permissions changes.

Script is non-obvious, will share once I have mostly debugged it.

ht
-- 
       Henry S. Thompson, School of Informatics, University of Edinburgh
      10 Crichton Street, Edinburgh EH8 9AB, SCOTLAND -- (44) 131 650-4440
                Fax: (44) 131 650-4587, e-mail: ht@inf.ed.ac.uk
                       URL: http://www.ltg.ed.ac.uk/~ht/
 [mail from me _always_ has a .sig like this -- mail without it is forged spam]

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Repairing permissions after windows reinstall

[Andrey Repin]

Greetings, Henry S. Thompson!

> Andrey Repin writes:

>> Greetings, Henry S. Thompson!
>>
>>> Good news: My cygwin file tree survived a Windows (10) reinstall
>>> Not-so-good news: I have a new SID, so not only do I not own those files
>>> any more (that's easily fixed), but I don't have the permissions I
>>> should, because they are now held by some miscellaneous old SID.
>>
>> So, what? Go to top directory properties, Advanced, Owner tab, Change, and
>> change the owner to what is desired.

> Much to glib an answer.  Changing the owner is the _last_ thing you want
> to do after (programmatically) changing a bunch of ACLs.

Much like in POSIX, ACL and ownership are not directly dependent one on
another in Windows.
I don't understand your statement.


-- 
With best regards,
Andrey Repin
Monday, July 4, 2016 06:25:58

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Repairing permissions after windows reinstall

[Corinna Vinschen]

[-- Attachment #1: Type: text/plain, Size: 1223 bytes --]

On Jul  4 06:27, Andrey Repin wrote:
> Greetings, Henry S. Thompson!
> 
> > Andrey Repin writes:
> 
> >> Greetings, Henry S. Thompson!
> >>
> >>> Good news: My cygwin file tree survived a Windows (10) reinstall
> >>> Not-so-good news: I have a new SID, so not only do I not own those files
> >>> any more (that's easily fixed), but I don't have the permissions I
> >>> should, because they are now held by some miscellaneous old SID.
> >>
> >> So, what? Go to top directory properties, Advanced, Owner tab, Change, and
> >> change the owner to what is desired.
> 
> > Much to glib an answer.  Changing the owner is the _last_ thing you want
> > to do after (programmatically) changing a bunch of ACLs.
> 
> Much like in POSIX, ACL and ownership are not directly dependent one on
> another in Windows.

Bzz.  POSIX ACLs maintain the concept of owner ACE and group ACE.  They
*are* distinguished from the ACEs of other users and groups in an ACL.
The fact that Windows ACLs don't do that is a real downside.  Not a bug
per se, but ugly.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: Repairing permissions after windows reinstall

[Andrey Repin]

Greetings, Corinna Vinschen!

> On Jul  4 06:27, Andrey Repin wrote:
>> Greetings, Henry S. Thompson!
>> 
>> > Andrey Repin writes:
>> 
>> >> Greetings, Henry S. Thompson!
>> >>
>> >>> Good news: My cygwin file tree survived a Windows (10) reinstall
>> >>> Not-so-good news: I have a new SID, so not only do I not own those files
>> >>> any more (that's easily fixed), but I don't have the permissions I
>> >>> should, because they are now held by some miscellaneous old SID.
>> >>
>> >> So, what? Go to top directory properties, Advanced, Owner tab, Change, and
>> >> change the owner to what is desired.
>> 
>> > Much to glib an answer.  Changing the owner is the _last_ thing you want
>> > to do after (programmatically) changing a bunch of ACLs.
>> 
>> Much like in POSIX, ACL and ownership are not directly dependent one on
>> another in Windows.

> Bzz.  POSIX ACLs maintain the concept of owner ACE and group ACE.  They
> *are* distinguished from the ACEs of other users and groups in an ACL.
> The fact that Windows ACLs don't do that is a real downside.  Not a bug
> per se, but ugly.

Yes, it's not a bug, it's a design decision. Windows permissions are explicit.
You can have a file owner with no associated permissions, it means that you
can change file permissions. You will not have access to the file, until you
do that. Even being the owner.
Though, Windows ACL do have concept of "owner" and "group" permissions, but
they are either inherited directory attributes, or immediately translated to
the current file owner upon commit.
And I like this approach much more, than POSIX implicit permissions.


-- 
With best regards,
Andrey Repin
Tuesday, July 5, 2016 17:37:44

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Repairing permissions after windows reinstall -- scripts to do it

[Henry S. Thompson]

Here's what worked for me in the end, over several days (I had several
hundred thousand files to fix):

These could be parameterised much better, but I leave that as an
exercise to the user...

These both use subinacl, as getting /substitute ... /restore to work
with icacls was beyond me.

fixPerms.sh (to fix a single directory or file):

#!/bin/bash
d=${1:-.}
#echo "fp: |$d|"
# Download subinacl
#  from https://www.microsoft.com/en-gb/download/details.aspx?id=23510
/c/Program\ Files\ \(x86\)/Windows\ Resource\ Kits/Tools/subinacl /file "$d" /replace=S-1-5-21-xxx-1001=luther\\[me]
/c/Program\ Files\ \(x86\)/Windows\ Resource\ Kits/Tools/subinacl /file "$d" /replace=S-1-5-21-xxx-513=luther\\None
/c/Program\ Files\ \(x86\)/Windows\ Resource\ Kits/Tools/subinacl /file "$d" /replace=S-1-5-21-yyy-1001=luther\\[me]
/c/Program\ Files\ \(x86\)/Windows\ Resource\ Kits/Tools/subinacl /file "$d" /replace=S-1-5-21-yyy-513=luther\\None
icacls "$d" /remove "NULL SID"
chown [me] "$d"

You'll have to replace [me] with your username, and xxx with the meat of
whatever SIDs your new install has given you and "Domain Users".  The
second pair of subinacl calls are there because I had done more than one
reinstall, so had more than one stale persona to replace -- if you only
have one stale persona, you obviously don't need them.

walkPerms.sh (to fix a whole tree):

#!/bin/bash
fixPerms.sh . > /dev/null
n=0
find "$@" \( \( -uid 98765 \) -o \( -uid 98766 \) \) -print0| tr '\000' '\012'| \
while read d
 do
 # echo "|$d|"
 wd=$(cygpath -w "$d")
 n=$((n + 1))
 if [ "$n" = "50" ]
 then
   echo $wd
   n=0
 fi
 if [ -h "$d" ]
 then
    chown -h [me] "$d"
    chgrp -h None "$d"
 else
    /c/Program\ Files\ \(x86\)/Windows\ Resource\ Kits/Tools/subinacl /file "$wd" /replace=S-1-5-21-xxx-1001=luther\\ht >/dev/null
    /c/Program\ Files\ \(x86\)/Windows\ Resource\ Kits/Tools/subinacl /file "$wd" /replace=S-1-5-21-xxx-513=luther\\None >/dev/null
    /c/Program\ Files\ \(x86\)/Windows\ Resource\ Kits/Tools/subinacl /file "$wd" /replace=S-1-5-21-yyy-1001=luther\\ht >/dev/null
    /c/Program\ Files\ \(x86\)/Windows\ Resource\ Kits/Tools/subinacl /file "$wd" /replace=S-1-5-21-yyy-513=luther\\None >/dev/null
    icacls "$wd" /remove "NULL SID" >/dev/null
    chown [me] "$d"
 fi
done

Same replacements required for [me] and xxx (and maybe yyy) as above.  I
didn't copied fixPerms.sh into the loop instead of invoking it by name
in order to avoid 100,000s of (slow) forks -- I'm sure there are other
optimisations which could be done.

Finally, note that the uids used in the 'find' at the beginning of
walkPerms.sh above are whatever you've added in your /etc/passwd per
Corinna's earlier message [1], e.g.

me0:*:98765:197121:U-LUTHER\me0,S-1-5-21-xxx-1001:/:/sbin/nologin
me1:*:98766:197121:U-LUTHER\me1,S-1-5-21-yyy-1001:/:/sbin/nologin

If the 'find' doesn't produce anything when you think it should, read
the documentation about /etc/nsswitch.conf [2] and make sure it's either
absent or getting /etc/passwd read.

Hope this helps someone down the line,

ht

[1] https://cygwin.com/ml/cygwin/2016-06/msg00393.html
[2] https://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-mapping-nsswitch
-- 
       Henry S. Thompson, School of Informatics, University of Edinburgh
      10 Crichton Street, Edinburgh EH8 9AB, SCOTLAND -- (44) 131 650-4440
                Fax: (44) 131 650-4587, e-mail: ht@inf.ed.ac.uk
                       URL: http://www.ltg.ed.ac.uk/~ht/
 [mail from me _always_ has a .sig like this -- mail without it is forged spam]

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

Re: Repairing permissions after windows reinstall

[Bryan Berns]

> In fact I see _two_ raw SIDs when I look at the security tab for any
> directory in the old cygwin tree: one has Full control, and the other
> just Read & execute.
>

If everyone else's posts don't get you where you want, I have a
recently-written program that can do a search/replace on a SID (or
named account) on an entire directory directory (addresses DACL/SACL
group SID, owner SID).  Message me directly if you're interested.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple