Unexpected permissions for home dir install

Unexpected permissions for home dir install

[carbonfiber123irc carbonfiber123irc]

Hello

I have experienced the following unexpected default
behavior when installing cygwin inside my home directory.

Using the --no-admin option and choosing "just me" in the setup.

As user1 when installing cygwin to:
"C:\Users\user1\Downloads\cygwin_test1\"

Then all the directories and files have the read and execute
permissions for the "Everyone" SID.

This means a user2 on the same system can read files inside
"C:\Users\user1\Downloads\cygwin_test1\home\user1\"

It also means that user2 can use stuff in the cygwin install
such as bash, even though I did not intend for that to be available
to user2.

The above applies both to the newest cygwin setup from the cygwin
website as of this writing, and also to the 2.921 setup.

I have worked around the issue myself by setting the permissions
manually after the install. So I am just writing this to inform
you that I found the behavior unexpected, and then you can determine
if you consider it a bug or not.

Unexpected permissions for home dir install

[carbonfiber123irc carbonfiber123irc]

[-- Attachment #1: Type: text/plain, Size: 968 bytes --]

Hello

I have experienced the following unexpected default
behavior when installing cygwin inside my home directory.

Using the --no-admin option and choosing "just me" in the setup.

As user1 when installing cygwin to:
"C:\Users\user1\Downloads\cygwin_test1\"

Then all the directories and files have the read and execute
permissions for the "Everyone" SID.

This means a user2 on the same system can read files inside
"C:\Users\user1\Downloads\cygwin_test1\home\user1\"

It also means that user2 can use stuff in the cygwin install
such as bash, even though I did not intend for that to be available
to user2.

The above applies both to the newest cygwin setup from the cygwin
website as of this writing, and also to the 2.921 setup.

I have worked around the issue myself by setting the permissions
manually after the install. So I am just writing this to inform
you that I found the behavior unexpected, and then you can determine
if you consider it a bug or not.

Re: Unexpected permissions for home dir install

[Ken Brown]

On 8/31/2022 2:42 PM, carbonfiber123irc carbonfiber123irc wrote:
> Hello
> 
> I have experienced the following unexpected default
> behavior when installing cygwin inside my home directory.
> 
> Using the --no-admin option and choosing "just me" in the setup.
> 
> As user1 when installing cygwin to:
> "C:\Users\user1\Downloads\cygwin_test1\"
> 
> Then all the directories and files have the read and execute
> permissions for the "Everyone" SID.
> 
> This means a user2 on the same system can read files inside
> "C:\Users\user1\Downloads\cygwin_test1\home\user1\"
> 
> It also means that user2 can use stuff in the cygwin install
> such as bash, even though I did not intend for that to be available
> to user2.
> 
> The above applies both to the newest cygwin setup from the cygwin
> website as of this writing, and also to the 2.921 setup.
> 
> I have worked around the issue myself by setting the permissions
> manually after the install. So I am just writing this to inform
> you that I found the behavior unexpected, and then you can determine
> if you consider it a bug or not.

Setup displays the following text below the "Just Me" button:

   Cygwin will still be available to all users, but Desktop Icons,
   Cygwin Menu Entries, and important Installer information are
   only available to the current user.  Only select this if you
   lack Administrator privileges or if you have specific needs.

This is consistent with what you observed.

Ken

Unexpected permissions for home dir install

[carbonfiber123irc carbonfiber123irc]

I did read that upon installation.

But I read it more as:
"Cygwin is still available to multiple users, depending
on where you install it".

I did not expect it to apply when installing Cygwin into a
private home directory.

And maybe other people read it similar to how I read it.

But its also entirely possible that its just me, and that
I should be more careful about my assumptions the next time
I install something.

Unexpected permissions for home dir install

[carbonfiber123irc carbonfiber123irc]

[-- Attachment #1: Type: text/plain, Size: 423 bytes --]

I did read that upon installation.

But I read it more as:
"Cygwin is still available to multiple users, depending
on where you install it".

I did not expect it to apply when installing Cygwin into a
private home directory.

And maybe other people read it similar to how I read it.

But its also entirely possible that its just me, and that
I should be more careful about my assumptions the next time
I install something.