DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type:content-transfer-encoding;
	 q=dns; s=default; b=VBOHWeTvqEeHLKF5ZQEGMRRF8Gcnu4bjrWdDYtzUDF3
	YUKXYbdj2YmU/i7/XFMfBFKZ0NR8E5dP87KRlEvdzXfu1eYGQ+qMk3oGxO9E1b2Q
	LSEmeztpPDWZ+BOH8J4+7vlMDKY0nxKLDr5vOWf9A1tFlTpQZUuMKdmry61nRBQY
	=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Message-ID: <5400F2EE.8020604@cornell.edu>
Date: Fri, 29 Aug 2014 17:38:54 -0400
From: Ken Brown <kbrown@cornell.edu>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.6.0
MIME-Version: 1.0
To: cygwin@cygwin.com
Subject: Re: (call-process ...) hangs in emacs
References: <87wq9v9j2y.fsf@Rainer.invalid> <53FD0662.5050208@cornell.edu>	<20140827084245.GD20700@calimero.vinschen.de>	<53FDD4A8.5050401@cornell.edu>	<loom.20140827T170804-533@post.gmane.org>	<loom.20140828T085927-71@post.gmane.org>	<20140828095524.GO20700@calimero.vinschen.de>	<20140828131832.GT20700@calimero.vinschen.de>	<loom.20140828T172529-396@post.gmane.org>	<loom.20140829T115632-276@post.gmane.org>	<20140829110938.GD20700@calimero.vinschen.de>	<5400C19D.4070408@cornell.edu> <87ha0vhzge.fsf@Rainer.invalid>	<5400D64D.1090709@cornell.edu> <87d2bjhxqx.fsf@Rainer.invalid>
In-Reply-To: <87d2bjhxqx.fsf@Rainer.invalid>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

On 8/29/2014 4:00 PM, Achim Gratz wrote:
> Ken Brown writes:
>> I just checked /var/log/sshd.log.  (I hadn't thought to do that
>> before.) The last message in it is, "/var/empty must be owned by root
>> and not group or world-writable."  So the problem seems to be that
>> /var/empty appears to sshd to be group writable under the latest
>> snapshot.  This is the "downside" that Corinna mentioned.  What needs
>> to be done to /var/empty to fix this?
> 
> You need to remove all ACL from the directory, either with setfacl or
> (from cmd) icacls or even the security tab in Explorer.  Most likely
> these are inherited from the parent directory of the Cygwin
> installation.

The ACLs aren't inherited.  They're explicitly set by ssh-host-config:

if ! /usr/bin/setfacl -m u:system:rwx "${LOCALSTATEDIR}/empty" >/dev/null 2>&1
then
  csih_warning "Can't set extended permissions on ${LOCALSTATEDIR}/empty!"
  let ++warning_cnt
fi

This must be done for a reason, but I don't know what it is.

Ken

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple