X-Recipient:	archive-cygwin AT delorie DOT com
X-Spam-Check-By:	sourceware.org
Message-ID:	<4897A422.4040405@cwilson.fastmail.fm>
Date:	Mon, 04 Aug 2008 20:51:46 -0400
From:	Charles Wilson <cygwin AT cwilson DOT fastmail DOT fm>
User-Agent:	Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.16) Gecko/20080708 Thunderbird/2.0.0.16 Mnenhy/0.7.5.666
MIME-Version:	1.0
To:	cygwin AT cygwin DOT com
Subject:	Re: CSIH file permission tests on non-NTFS broken (was Re: ssh-host-config script fails)
References:	<2B02F35EEE21064E9EF7F377F7F37D7402949615 AT ADMAIL01 DOT ICSDMN DOT local> <20080723163450 DOT GY5251 AT calimero DOT vinschen DOT de> <20080724092249 DOT GC28166 AT calimero DOT vinschen DOT de> <20080730124957 DOT GN29031 AT calimero DOT vinschen DOT de> <48914567 DOT 3010100 AT cwilson DOT fastmail DOT fm> <20080731075001 DOT GA22385 AT calimero DOT vinschen DOT de>
In-Reply-To:	<20080731075001.GA22385@calimero.vinschen.de>
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com

Corinna Vinschen wrote:
> A check for non-NTFS should be sufficient for now, IMHO.  It's bad
> enough to run an OS on such an insecure file system, but it's hard to
> enforce upgrading to NTFS.  However, ntsec and smbntsec are dead in the
> water and I don't think we should encourage usage of noacl more than
> necessary, especially for sensitive services.

So, I'd basically need to check the fstype for each of the directories 
of interest (they MAY all be on the same volume, but not necessarily).
    /var
    /var/run
    /var/log
    /var/empty
    /etc
So, how do I do that portably?  The 1.7 version of mount returns that 
information, but the 1.5 version does not.  What if I import your 
getvolinfo program
   http://cygwin.com/ml/cygwin/2007-08/msg00040.html
as one of the csih helper progs, and put it under /usr/lib/csih/ 
(alternatively, import getvolinfo into cygutils).

In that case, I wouldn't need to check for NTFS at all -- instead, I'd 
check for "FILE_PERSISTENT_ACLS[ ]*: TRUE", right?

Or is there a better way?

--
Chuck

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

- Raw text -