DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:content-type:mime-version:subject:from
	:in-reply-to:date:content-transfer-encoding:message-id
	:references:to; q=dns; s=default; b=PquOr9fHBKN1IQFzK7XIToL0z+AH
	0Ih1f0hvvpCYeDJU8k4NHmd1B3gTtCcOaJ4xdlLhcs+Lqx1hFK1qGdi/1VNCuu1P
	Wp+JM5NHySU/PiKxGVbmk1jo9ZL6jJSqPe9h9Wi9ptKaVMC9HbJaA5oJIFOYnkRi
	pjj06GcrHDxEXu4=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
Subject: Re: /usr/local, /var and */tmp in c:\Users\Public
From: Warren Young <warren@etr-usa.com>
In-Reply-To: <CAD8GWstJ+BkbkCJfE_48=b2cg0uzc8pkd1UnevP6-=3DHL+Buw@mail.gmail.com>
Date: Tue, 18 Nov 2014 14:29:18 -0700
Message-Id: <72FA6025-B953-41D1-B1EE-D081DC347714@etr-usa.com>
References: <81578012-FD3F-4463-BC56-ADB092317DD4@etr-usa.com>	<CABa6CEkRV=3FY6ZVGrdt--rH3PppwCJRD5poU0L2knv2k2ce_w@mail.gmail.com>	<25F385A9-3E2D-44FC-998F-D2672F67DFE4@etr-usa.com>	<m40npq$vrq$1@ger.gmane.org>	<ECD073FF-B78C-4D19-8DE1-5F4E390D2495@etr-usa.com>	<20141113093335.GI2782@calimero.vinschen.de>	<40005E53-A327-4E4A-8C71-514E505F9FBC@etr-usa.com> <CAD8GWstJ+BkbkCJfE_48=b2cg0uzc8pkd1UnevP6-=3DHL+Buw@mail.gmail.com>
To: cygwin@cygwin.com
Content-Transfer-Encoding: 8bit

On Nov 15, 2014, at 10:55 AM, Lee <ler762@gmail.com> wrote:

> On 11/13/14, Warren Young   wrote:
>> I installed Cygwin with my regular user account,
> 
> You're doing it wrong.  Install Cygwin using an admin account and
> regular user accounts are not allowed write access to system
> files/directories:

While my idea does have applicability to multi-user Windows systems, I also want it to work without using Admin gymnastics on a single-user Windows system.

That is, I want this:

    $ echo -n "" >> /usr/bin/vi

to fail just as this does:

    $ echo -n "" >> /cygdrive/c/Windows/notepad.exe
    -bash: /cygdrive/c/Windows/notepad.exe: Permission denied

I want them both to fail for the same reason: normal users — whether they are members of group Administrators or not — have no business writing to system files.  Only the installer process (Cygwin Setup in this case) should be able to do that.

For what it’s worth:

$ cd /cygdrive/c/Windows
$ icacls notepad.exe
notepad.exe NT SERVICE\TrustedInstaller:(F)
            BUILTIN\Administrators:(RX)
            NT AUTHORITY\SYSTEM:(RX)
            BUILTIN\Users:(RX)
            APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX)


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple