public inbox for cygwin@cygwin.com
 help / color / mirror / Atom feed
* Re[2]: Issues with ACL settings after updating to the latest cygwin.dll
@ 2016-02-10 18:18 xnor
  2016-02-10 20:50 ` Andrey Repin
  2016-02-11 10:25 ` Corinna Vinschen
  0 siblings, 2 replies; 8+ messages in thread
From: xnor @ 2016-02-10 18:18 UTC (permalink / raw)
  To: cygwin


>Which warning do you mean here?
The "permissions out of order" one. This was not the case before, at 
least not on my installation, so I don't see how this can be called 
normal.


>Come on, be fair.  The new ACL handling started out early 2015, got a
>break when I realized that it doesn't work as is, and then got a new
>test phase starting back in September.  Except for minor bugs it seemed
>to work rather well.  Nobody reported this effect in all the 4 months 
>of
>test period.  You don't actually think I wouldn't have fixed it prior
>to the release if I had known about it, do you?
2.4.0-1 was released ~3 weeks ago. I had actually upgraded a few days 
earlier to a TEST version and noticed that a cygwin downloaded exe 
couldn't be executed but assumed the exe was corrupt and didn't 
investigate...
Then a few days ago the same thing happened again. Now I'm here.

Anyway, clearly most users are just that: users, and not testers that 
will install and test TEST versions.


>They are not supposed to be modifiable in Explorer.  If you want to
>change permissions on a Cygwin ACL, use chmod or setfacl.
Is this a joke?


>
>>  Here is the output from icacls /saveacl for some file:
>>  
>>D:P(D;;RPWPDTRC;;;S-1-0-0)(A;;0x1f019f;;;S-1-5-21-559282050-488988736-2019639472-1001)(D;;WP;;;AU)(D;;WP;;;SY)(D;;WP;;;BA)(D;;WP;;;BU)(A;;FR;;;S-1-5-21-559282050-488988736-2019639472-513)(A;;0x1201bf;;;AU)(A;;0x1201bf;;;SY)(A;;0x1201bf;;;BA)(A;;0x1200a9;;;BU)(A;;FR;;;WD)
>Doh, I'm sorry, but I can't read this format very well.  Can you please
>again send the standard icacls output as well as the output from 
>getfacl
>of the parent dir and the created file?  I'd like to have this problem
>fixed, but I need your help.  As I said, it works fine for me and 
>without
>being able to reproduce I'm somewhat at a loss.
You can import this by putting it in a textfile and using icacls 
testfile /restore acl.txt.
As I've said before, my Windows is German. icacls output will be 
localized. Do you really want that?
What I posted is the only portable way to share ACLs.


>
>>  Here is what's "normal" for Windows if I create a file under a new 
>>folder on
>>  C: in Explorer:
>
>If you don't want POSIX perms, but standard Windows perms, use the 
>"noacl"
>mount option.  See 
>https://cygwin.com/cygwin-ug-net/using.html#mount-table
I guess that is my only option right now.

>
>>  Here is what I would expect:
>>  MyUser is in the group Administrators. Given the inherited 
>>permissions above
>>  a Windows-created file should be shown as "-rwxrwxr--+ MyUser
>>  Administrators"?
>
>Sorry, can't do that, *unless* you make "Administrators" the primary
>group in your user token(*).
Ok, so the group is "None". No big deal.

So what about fixing the permissions like I described?
So the permissions would be "-rwx------+ MyUser None" in Cygwin for a 
Windows-created file with default ACL.

By using the inherited default ACLs there should be at most 3 additional 
ACLs (+1 for NULL SID whatever that is doing):
- deny r/w/x for user ("MyUser")
- allow r/w/x for group ("None")
- allow r/w/x for other ("Everyone")

And leaving the inherited ones untouched, right?
But if you scroll up you will see that in my system Cygwin kills the 
inheritance and I end up with 12 new ACL entries for each file.


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: Issues with ACL settings after updating to the latest cygwin.dll
  2016-02-09 20:53 ` Re[2]: " xnor
@ 2016-02-10  2:20 Andrey Repin
  2016-02-10 17:39 ` Re[2]: " xnor
  -1 siblings, 1 reply; 8+ messages in thread
From: Andrey Repin @ 2016-02-10  2:20 UTC (permalink / raw)
  To: xnor, cygwin

Greetings, xnor!

>>The permissions must *not* be reordered.  If Cygwin creates permissions
>>incorrectly it's one thing, but the order to emulate POSIX permissions
>>is non-canonical.  Reordering them will break them.
>>
>>Please provide the exact output from icacls.
> They *have* to be reordered to be modifiable in Windows/Explorer. In 
> other words, if I want to change permission the new ACL behavior ensures 
> that it breaks the Cygwin permissions?

It was always the case.
Permissions are NOT REQUIRED to be ordered in a specific way, but Explorer is
only capable of editing them in the only one way.
Means, Explorer is deficient. Explorer. Not Windows. Windows is perfectly
capable of handling the Cygwin ACL in the intended way.


-- 
With best regards,
Andrey Repin
Wednesday, February 10, 2016 05:05:14

Sorry for my terrible english...


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: Issues with ACL settings after updating to the latest cygwin.dll
  2016-02-08 17:48 ` Re[2]: " xnor
@ 2016-02-08 18:20 Corinna Vinschen
  2016-02-09 20:53 ` Re[2]: " xnor
  -1 siblings, 1 reply; 8+ messages in thread
From: Corinna Vinschen @ 2016-02-08 18:20 UTC (permalink / raw)
  To: cygwin

[-- Attachment #1: Type: text/plain, Size: 2633 bytes --]

On Feb  8 17:48, xnor wrote:
> 
> >I'm not quite sure what you observe there.  The NULL SID ACE only
> >contains extra information about some POSIX bits and the MASK value.
> >It's existence and setting should not influence what you can do with the
> >file.  The permission bits are explicitely set elsewhere in the ACL.
> >
> >Can you reproduce the issue so that I can see what's going on?  I need
> >the icacls output for the file and its parent directory, as well as the
> >output from getfacl for both.
> I have the same problem with Transmission.
> 
> I noticed this first when I tried to execute an exe that was downloaded with
> Transmission compiled in cygwin. When trying to start the exe from Explorer
> an error dialog will appear:
> "Windows cannot access the specified device, path, or file. You may not have
> the appropriate permissions to access the item."

Not sure what Transmission is, but files downloaded with POSIX
tools are usually not executable.  For instance, download Cygwin's
setup-x86.exe with wget.  Then try to execute it.  It won't since
the permissions are set according to your umask and without execute
permissions, e.g., 0644.  This is normal.

> When going to file properties - security I get an information dialog window:
> "The permissions on <program> are incorrectly ordered, which may cause some
> entries to be ineffective."
> 
> Proper permissions (of parent folder) look like this:
> Authenticated Users: modify
> SYSTEM: Full control
> Administrators: Full control
> Users: Read & execute
> 
> 
> The permissions of the cygwin/transmission created files are (manually
> translated from German):
> NULL SID: special
> <My User>: special
> Authenticated Users: Browse folder / Execute file
> SYSTEM: Browse folder / Execute file
> Administrators: Browse folder / Execute file
> Users: Browse folder / Execute file
> Nobody: Read
> Authenticated Users: Read, write, execute
> SYSTEM: Read, write, execute
> Administrators: Read, write, execute
> Users: Read, Execute
> Everyone: Read
> 
> 
> Also when going to advanced permissions it shows the same incorrectly
> ordered warning and asks me to re-order permissions.

The permissions must *not* be reordered.  If Cygwin creates permissions
incorrectly it's one thing, but the order to emulate POSIX permissions
is non-canonical.  Reordering them will break them.

Please provide the exact output from icacls.


Thanks,
Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: Issues with ACL settings after updating to the latest cygwin.dll
@ 2016-02-08 14:16 Corinna Vinschen
  2016-02-08 17:48 ` Re[2]: " xnor
  0 siblings, 1 reply; 8+ messages in thread
From: Corinna Vinschen @ 2016-02-08 14:16 UTC (permalink / raw)
  To: cygwin

[-- Attachment #1: Type: text/plain, Size: 1049 bytes --]

On Jan 29 17:52, K Stahl wrote:
> I've discovered that when I use cvs to pull a module, the security
> settings on the created files and directories are incorrect.  When I
> view the security settings of the files, I noticed an invalid "NULL
> SID" group permission was added.  If I delete this value, I can
> properly execute the file, but if I leave it there, the file I'm
> trying to execute will not run.

I'm not quite sure what you observe there.  The NULL SID ACE only
contains extra information about some POSIX bits and the MASK value.
It's existence and setting should not influence what you can do with the
file.  The permission bits are explicitely set elsewhere in the ACL.

Can you reproduce the issue so that I can see what's going on?  I need
the icacls output for the file and its parent directory, as well as the
output from getfacl for both.


Thanks,
Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2016-02-11 10:25 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-02-10 18:18 Re[2]: Issues with ACL settings after updating to the latest cygwin.dll xnor
2016-02-10 20:50 ` Andrey Repin
2016-02-10 22:40   ` Re[2]: " xnor
2016-02-10 23:35     ` Andrey Repin
2016-02-11 10:25 ` Corinna Vinschen
  -- strict thread matches above, loose matches on Subject: below --
2016-02-10  2:20 Andrey Repin
2016-02-10 17:39 ` Re[2]: " xnor
2016-02-08 18:20 Corinna Vinschen
2016-02-09 20:53 ` Re[2]: " xnor
2016-02-08 14:16 Corinna Vinschen
2016-02-08 17:48 ` Re[2]: " xnor

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).