X-Recipient: archive-cygwin@delorie.com X-Spam-Check-By: sourceware.org Message-ID: <4897A422.4040405@cwilson.fastmail.fm> Date: Mon, 04 Aug 2008 20:51:46 -0400 From: Charles Wilson User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.16) Gecko/20080708 Thunderbird/2.0.0.16 Mnenhy/0.7.5.666 MIME-Version: 1.0 To: cygwin@cygwin.com Subject: Re: CSIH file permission tests on non-NTFS broken (was Re: ssh-host-config script fails) References: <2B02F35EEE21064E9EF7F377F7F37D7402949615@ADMAIL01.ICSDMN.local> <20080723163450.GY5251@calimero.vinschen.de> <20080724092249.GC28166@calimero.vinschen.de> <20080730124957.GN29031@calimero.vinschen.de> <48914567.3010100@cwilson.fastmail.fm> <20080731075001.GA22385@calimero.vinschen.de> In-Reply-To: <20080731075001.GA22385@calimero.vinschen.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Delivered-To: mailing list cygwin@cygwin.com Corinna Vinschen wrote: > A check for non-NTFS should be sufficient for now, IMHO. It's bad > enough to run an OS on such an insecure file system, but it's hard to > enforce upgrading to NTFS. However, ntsec and smbntsec are dead in the > water and I don't think we should encourage usage of noacl more than > necessary, especially for sensitive services. So, I'd basically need to check the fstype for each of the directories of interest (they MAY all be on the same volume, but not necessarily). /var /var/run /var/log /var/empty /etc So, how do I do that portably? The 1.7 version of mount returns that information, but the 1.5 version does not. What if I import your getvolinfo program http://cygwin.com/ml/cygwin/2007-08/msg00040.html as one of the csih helper progs, and put it under /usr/lib/csih/ (alternatively, import getvolinfo into cygutils). In that case, I wouldn't need to check for NTFS at all -- instead, I'd check for "FILE_PERSISTENT_ACLS[ ]*: TRUE", right? Or is there a better way? -- Chuck -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/