Re: cygwin utils can access directory and its contents, but W10 utils claim to have no access, why?

[Brian Inglis <Brian.Inglis@SystematicSW.ab.ca>]

On 2024-01-21 23:18, John Ruckstuhl via Cygwin wrote:
> I am seeing a weird phenomenon, hopefully someone can illuminate and teach.
> Or point me to an archived thread.
> 
> I have some folders that Cygwin utils can readily access,
> but W10 utils claim to have no access to.
> It feels as if
> *   the Cygwin utils try to do what they are commanded to do, and it's
>      up to the OS to refuse if the ACLs are insufficient.
> *   the W10 utils are written to decline to attempt access, due to some
>      convention or gentlemen's agreement (built into some API?).
> But wouldn't that lead Windows users to a false sense of protection, a
> false sense of security?
> 
> Environment
> *   Cygwin 3.4.9-1 on W10.  64-bit.
> *   UAC is not active (based on EnableLUA=0 at boot)
> 
> I have a 3rd-party program “yabba” that many different users run (on the
> same shared PC).
> It leaves behind a “temporary” dir (under
> C:/Users/username/AppData/Local/Temp), each time it’s run.
> Many times per day.
> These dirs are approx. 1000 files and 20 MB.
> The 3rd-party program is an exe-file compiled with pyinstaller.
> It unpacks a python script and a python interpreter, and runs the python
> script.
> But in our workflow, we usually terminate the execution brutally, so the
> pyinstaller cleanup does not happen, leaving the 20 MB behind.
> 
> I want Bob, a member of the local group Administrators, to remove these folders.
> 
> For example, ordinary user Alice runs yabba a couple of times and leaves
> behind 20 MB  in each of
>      C:/Users/Alice/AppData/Local/Temp/_MEI21002
>      C:/Users/Alice/AppData/Local/Temp/_MEI21282
> 
> Now for Local Administrator Bob, no impediment seeing these two dirs...
>      $ cd C\:/Users/Alice/AppData/Local/Temp
>      $ D1=_MEI21002
>      $ D2=_MEI21282
>      $ du -sh $D1 $D2
>      21M     _MEI21002
>      21M     _MEI21282
>      $ for D in $D1 $D2; do printf "%s\t%s\n" $D "$(find "$D" -mindepth
> 1 -type d -printf "dirs\n" -o -printf "files\n" | sort | uniq -c |
> paste - -)"; done
>      _MEI21002            34 dirs        940 files
>      _MEI21282            33 dirs        929 files
>      $ getfacl $D1 $D2
>      # file: _MEI21002
>      # owner: Alice
>      # group: Domain Users
>      user::rwx
>      group::---
>      group:OWNER RIGHTS:rwx
>      mask::rwx
>      other::---
> 
> 
>      # file: _MEI21282
>      # owner: Alice
>      # group: Domain Users
>      user::rwx
>      group::---
>      group:OWNER RIGHTS:rwx
>      mask::rwx
>      other::---
> 
> And (for Local Administrator Bob) no impediment to removing them, for example,
>      $ rm -r _MEI21282
> (success!)
> 
> BUT Windows utils run by Bob the Administrator on the remaining dir
> are blocked, like this
> (cmd, "Run as administrator"):
>      C:\Users\Alice\AppData\Local\Temp>dir _MEI21002
>      Volume in drive C is OSDisk
>      Volume Serial Number is 581C-10F2
> 
>      Directory of C:\Users\Alice\AppData\Local\Temp\_MEI21002
> 
>      File Not Found
> 
>      C:\Users\Alice\AppData\Local\Temp>icacls _MEI21002
>      _MEI21002: Access is denied.
>      Successfully processed 0 files; Failed processing 1 files
> 
> As a consequence, Windows utils run by Bob the Administrator cannot
> delete Alice's directory.  Until they do a takeown.
> 
> The first try to delete fails:
>      C:\Users\Alice\AppData\Local\Temp>del /S /Q _MEI21002
>      Could Not Find C:\Users\Alice\AppData\Local\Temp\_MEI21002\*
> 
> But a takeown succeeds
>      C:\Users\Alice\AppData\Local\Temp>takeown /A /F _MEI21002 /R /D Y
> 
> Now icacls has access
>      C:\Users\Alice\AppData\Local\Temp>icacls _MEI21002
>      _MEI21002 BUILTIN\Administrators:(OI)(IO)(F)
>                BUILTIN\Administrators:(CI)(F)
> 
>      Successfully processed 1 files; Failed processing 0 files
> 
> And the second try to delete succeeds
>      C:\Users\Alice\AppData\Local\Temp>del /S /Q _MEI21002
> 
> In summary, why is it that Bob the Administrator can Cygwin "rm.exe" to
> delete these folders without taking ownership, but to delete with
> Windows utils, he needs to take ownership first?

I normally find the problem is that a directory has no useful Windows DACLs 
defined, so directories or files created in it by Cygwin programs are not 
accessible to Windows programs.
It seems to me, that when Cygwin creates directories or files in those 
directories, they have no Windows ACLs defaulted, but they seem to look fine to 
Cygwin's assumed POSIX permissions, as if on FAT drives?
Better explanations would be welcome.

For directories, run:

	$ lsattr -adl 	$D
	$ ls -adlL	$D
	$ getfacl	$D
	$ icalcs "$(cygpath -m "$D")"

and for files, skip lsattr.

This should show you all the views of permissions you need to figure out the issue.

-- 
Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada

La perfection est atteinte                   Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer     but when there is no more to cut
                                 -- Antoine de Saint-Exupéry