X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:in-reply-to:references:date
	:message-id:mime-version:content-type:content-transfer-encoding;
	q=dns; s=default; b=nqtMeLJHK0iZITzL6elxlBVvNcxbqtvWcVu661gjDKg
	j1KtCjMSfE/wg0UlnR21G1IL4/mRdeGFpoKn639QT4Lcu2x3sUpyFH+bkEazSkdu
	yLb/eBZ3qZrpFrs1V1f9c7vviGX18T5Gr5KPnoBgGI2RJ01NusePwm42qUBoEV50
	=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:in-reply-to:references:date
	:message-id:mime-version:content-type:content-transfer-encoding;
	s=default; bh=IWtwlJ/gECIm71TaXuq/Gjz2zDM=; b=ZJNc+ajsntehGzKsj
	mkRzJIx80DU7vtpWfjselmQc14nDfLWK9GQDu5KVuNxkvYvCrVjvb+PwiifEYAbX
	pRS9Upvz5HydaZfqWvaPW9LxIp97Sew4T478OYQ3wbSoHkocwV5NWTpLyOQDgPmN
	nUhKBV1QF5KNBTAYbcsnb0ZJEA=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Virus-Found:	No
X-Spam-SWARE-Status:	No, score=-0.4 required=5.0 tests=AWL,BAYES_50,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.2
X-HELO:	mail-in-01.arcor-online.net
X-DKIM:	Sendmail DKIM Filter v2.8.2 mail-in-02.arcor-online.net 3lP8wH6T1lz1Sq1
From:	Achim Gratz <Stromeko AT nexgo DOT de>
To:	cygwin AT cygwin DOT com
Subject:	Re: [TESTERS needed] New POSIX permission handling
In-Reply-To:	<20150410100703.GA4401@calimero.vinschen.de> (Corinna Vinschen's message of "Fri, 10 Apr 2015 12:07:03 +0200")
References:	<20150410100703 DOT GA4401 AT calimero DOT vinschen DOT de>
User-Agent:	Gnus/5.13 (Gnus v5.13) Emacs/25.0.50 (gnu/linux)
Date:	Sat, 11 Apr 2015 10:47:03 +0200
Message-ID:	<87lhhzcarc.fsf@Rainer.invalid>
MIME-Version:	1.0
X-MIME-Autoconverted:	from quoted-printable to 8bit by delorie.com id t3B8lZ2w006043

Corinna Vinschen writes:
> - To accommodate Windows default ACLs, the new code ignores SYSTEM and
>   Administrators group permissions when computing the MASK/CLASS_OBJ
>   permission mask on old ACLs, and it doesn't deny access to SYSTEM and
>   Administrators group based on the value of MASK/CLASS_OBJ when
>   creating the new ACLs.

Since you've now opened that can of worms of who is considered "root",
what about "Domain Administrators" or "Power Users", for starters?

>   That means, even if SYSTEM or Administrators have full access to the
>   file, the POSIX permssion bits will not reflect that fact.  And while
>   other users get access denied based on the mask value, SYSTEM and
>   Administrators will never get access denied based on the mask.

If you want to put this to better use in larger settings it would seem
preferrable if it was possible to define a list of users to treat this
way in fstab.  I think this would help with the braindead settings
NetApp filers are set up these days by default.  That generally means
that some domain group(s) need to be considered root on the share
depending on which share you are accessing.

> Apart from bugfixing the aforementioned code, there's still work to do
> on the getfacl and setfacl tools:

Sorry to pile another one on here: Currently it's not possible to use -k
and -b on the same invocation.  This works just fine on Linux.

Having the newer getfacl / setfacl from *BSD that deals with NFSv4 ACL
might be worth a shot, since at least superficially these seem to match
better to NTFS DACL in scope and would probably bring it more in line
with what icacls would show and do.  Before you ask, it has been duly
noted that NFSv4 ACL are somewhat incompatible with POSIX ACL in the
same way that NTFS DACL areā€¦ maybe some more info can be gleaned from
those documents:

http://users.suse.com/~agruen/acl/linux-acls/online/
http://users.suse.com/~agruen/nfs4acl/
http://www.ietf.org/archive/id/draft-ietf-nfsv4-acl-mapping-03.txt
http://www.bestbits.at/richacl/draft-gruenbacher-nfsv4-acls-in-posix-00.html
http://docs.oracle.com/cd/E23824_01/html/821-1448/gbacb.html


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Samples for the Waldorf Blofeld:
http://Synth.Stromeko.net/Downloads.html#BlofeldSamplesExtra

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -