X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type:content-transfer-encoding;
	q=dns; s=default; b=VBOHWeTvqEeHLKF5ZQEGMRRF8Gcnu4bjrWdDYtzUDF3
	YUKXYbdj2YmU/i7/XFMfBFKZ0NR8E5dP87KRlEvdzXfu1eYGQ+qMk3oGxO9E1b2Q
	LSEmeztpPDWZ+BOH8J4+7vlMDKY0nxKLDr5vOWf9A1tFlTpQZUuMKdmry61nRBQY
	=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type:content-transfer-encoding;
	s=default; bh=p6MMzA7aBY5HLyrIuJiA8YEtGaY=; b=tGWhjanm5rJj/ItSh
	q8teSy8oSlc63TiWtQIFnnvUoBdRPQk5CTBx4CA5v/BzjuJhE7jrJxfPb4DHx0Ui
	ScLKIAcZSLrIXaXJpf6lPkT2YUn4OjJqXOFTEDHTfMzKMDT05EPMy6sWTA1UOV5n
	76Bfy6Zh5GTU9GIDe9NT1tjYoE=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Virus-Found:	No
X-Spam-SWARE-Status:	No, score=-1.7 required=5.0 tests=AWL,BAYES_00,RP_MATCHES_RCVD,SPF_HELO_PASS,SPF_PASS autolearn=ham version=3.3.2
X-HELO:	limerock03.mail.cornell.edu
X-CornellRouted:	This message has been Routed already.
Message-ID:	<5400F2EE.8020604@cornell.edu>
Date:	Fri, 29 Aug 2014 17:38:54 -0400
From:	Ken Brown <kbrown AT cornell DOT edu>
User-Agent:	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0
MIME-Version:	1.0
To:	cygwin AT cygwin DOT com
Subject:	Re: (call-process ...) hangs in emacs
References:	<87wq9v9j2y DOT fsf AT Rainer DOT invalid> <53FD0662 DOT 5050208 AT cornell DOT edu> <20140827084245 DOT GD20700 AT calimero DOT vinschen DOT de> <53FDD4A8 DOT 5050401 AT cornell DOT edu> <loom DOT 20140827T170804-533 AT post DOT gmane DOT org> <loom DOT 20140828T085927-71 AT post DOT gmane DOT org> <20140828095524 DOT GO20700 AT calimero DOT vinschen DOT de> <20140828131832 DOT GT20700 AT calimero DOT vinschen DOT de> <loom DOT 20140828T172529-396 AT post DOT gmane DOT org> <loom DOT 20140829T115632-276 AT post DOT gmane DOT org> <20140829110938 DOT GD20700 AT calimero DOT vinschen DOT de> <5400C19D DOT 4070408 AT cornell DOT edu> <87ha0vhzge DOT fsf AT Rainer DOT invalid> <5400D64D DOT 1090709 AT cornell DOT edu> <87d2bjhxqx DOT fsf AT Rainer DOT invalid>
In-Reply-To:	<87d2bjhxqx.fsf@Rainer.invalid>
X-IsSubscribed:	yes

On 8/29/2014 4:00 PM, Achim Gratz wrote:
> Ken Brown writes:
>> I just checked /var/log/sshd.log.  (I hadn't thought to do that
>> before.) The last message in it is, "/var/empty must be owned by root
>> and not group or world-writable."  So the problem seems to be that
>> /var/empty appears to sshd to be group writable under the latest
>> snapshot.  This is the "downside" that Corinna mentioned.  What needs
>> to be done to /var/empty to fix this?
> 
> You need to remove all ACL from the directory, either with setfacl or
> (from cmd) icacls or even the security tab in Explorer.  Most likely
> these are inherited from the parent directory of the Cygwin
> installation.

The ACLs aren't inherited.  They're explicitly set by ssh-host-config:

if ! /usr/bin/setfacl -m u:system:rwx "${LOCALSTATEDIR}/empty" >/dev/null 2>&1
then
  csih_warning "Can't set extended permissions on ${LOCALSTATEDIR}/empty!"
  let ++warning_cnt
fi

This must be done for a reason, but I don't know what it is.

Ken

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -