DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type:content-transfer-encoding;
	 q=dns; s=default; b=tMG2AooxBBQXsB3xOzDXYNEXMnjtbnar6iUDYbyUjiW
	UpSKSWC58Hpsv/rrPdUQoVQkjrEZ00iB2U/f2wc7S140G5n7AYp3tHtoCKepgyHx
	XVFys+u7lpKm885R2JeC2aHudq3hbAxF/3qYzay46ms8hWMb0+iLkBOc2Ch9ykgk
	=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Message-ID: <548AFD43.1040306@cornell.edu>
Date: Fri, 12 Dec 2014 09:35:47 -0500
From: Ken Brown <kbrown@cornell.edu>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.3.0
MIME-Version: 1.0
To: cygwin@cygwin.com
Subject: Re: TEST RELEASE: Cygwin 1.7.34-002
References: <20141206194943.GD3810@calimero.vinschen.de> <CAMKht8iYnRuAJ7Eau6LDa_Jszxwo8YwybzwZNHjzWXLMUS8Y-w@mail.gmail.com>
In-Reply-To: <CAMKht8iYnRuAJ7Eau6LDa_Jszxwo8YwybzwZNHjzWXLMUS8Y-w@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

On 12/12/2014 8:49 AM, Michael DePaulo wrote:
> On Sat, Dec 6, 2014 at 2:49 PM, Corinna Vinschen
> <corinna-cygwin@cygwin.com> wrote:
>> I finally released another TEST version of the next upcoming Cygwin
>> release.  The version number is 1.7.34-002.
>
> I *think* I am experiencing a very bad regression.
>
> These are the Windows permissions on my ~/.ssh/id_rsa file:
> C:\cygwin\home\mike\.ssh>icacls id_rsa
> id_rsa NT AUTHORITY\SYSTEM:(F)
>         DEPAULO\mike:(R,W,D,WDAC,WO)
>
> Under cygwin 1.7.33-2, I am able to use the file fine:
>
> mike@executor ~
> $ uname -a
> CYGWIN_NT-6.3-WOW64 executor 1.7.33-2(0.280/5/3) 2014-11-13 15:45 i686 Cygwin
>
> mike@executor ~
> $ ssh galactica
> Enter passphrase for key '/home/mike/.ssh/id_rsa':
> Last login: Fri Dec 12 08:36:39 2014 from executor.depaulo.org
> mike@galactica:~ :) [1] $ exit
> logout
> Connection to galactica closed.
>
> mike@executor ~
> $ cd .ssh
>
> mike@executor ~/.ssh
> $ ls -latr id_rsa
> -rw------- 1 mike mkpasswd 1743 Dec  7  2013 id_rsa
>
>
> But under 1.7.34-002, I get a permissions error:
>
> mike@executor ~
> $ uname -a
> CYGWIN_NT-6.3-WOW64 executor 1.7.34(0.282/5/3) 2014-12-06 18:03 i686 Cygwin
>
> mike@executor ~
> $ ssh galactica
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> Permissions 0670 for '/home/mike/.ssh/id_rsa' are too open.
> It is recommended that your private key files are NOT accessible by others.
> This private key will be ignored.
> key_load_private_type: bad permissions
> mike@galactica's password:
>
>
> mike@executor ~
> $ cd .ssh
>
> mike@executor ~/.ssh
> $ ls -latr id_rsa
> -rw-rwx---+ 1 mike Domain Users 1743 Dec  7  2013 id_rsa

This isn't a regression.  It's a deliberate change, so that Cygwin now 
takes ACLs into account when calculating permissions.  The simplest fix 
is to use the new feature of setfacl to remove the unwanted permissions. 
  From the release announcement:

> - Add -b/--remove-all option to setfacl to reduce the ACL to only the
>   entries representing POSIX permission bits.

Ken


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple