DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:content-type:content-transfer-encoding; q=dns; s=default; b=WH1
	wgRYr5kxSdHJ3uFZeSiYGHZbru/BS0mTBX4OoxeikNmCYIzv5DoOdb6PRh40h7Bw
	+Tt8fAli+u5kqDST2fZZfu2xLLbJheMavZ2pS0YAzwopQZJVCXduAHnEfmPyYNuk
	wU3UZcN2fKz9LOUniGfwI9nmndAG9zKn0+19NF2Q=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Message-ID: <54D7EB4E.6020105@towo.net>
Date: Mon, 09 Feb 2015 00:03:42 +0100
From: Thomas Wolff <towo@towo.net>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: cygwin@cygwin.com
Subject: group permissions
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

With 1.7.34-6:
 > - the fixes in POSIX ACL handling and the effect this has on the standard
 >     POSIX group permissions, as well as the accompanying new setfacl(1)
 >     options -b/--remove-all and -k/--remove-default.
 >
 > Seehttps://cygwin.com/cygwin-ug-net/using-utils.html#setfacl
 > andhttps://cygwin.com/faq.faq.html#faq.using.ssh-pubkey-stops-working
 > andhttps://cygwin.com/faq.faq.html#faq.using.same-with-rhosts
Group permissions are now composed of multiple ACL entries, like:
-rw-rwx---+ 1 towo Domain Users   128 Feb  5 13:36 x
with ACL:
# file: x
# owner: towo
# group: Domain Users
user::rw-
group::r-x
group:SYSTEM:rwx
mask:rwx
other:---

chmod g-wx does not work on x, only after setfacl -d group:SYSTEM x ,
the g-w bit is gone.
This is surprising behaviour (and has been discussed in a specific
context in another thread);
the explanation is hidden in only roughly related sections of the user
guide (setfacl) or even the FAQ,
and is not found in the section Permissions and Security where one would
look first;
I suggest to add an illustrative section there.

However, I am not yet convinced that the explanation makes it less
surprising from a POSIX point of view
because the file does not have the group 'SYSTEM' which is responsible
for the g+wx flags.
Maybe ls -l should display a more permissive group (in the example case
SYSTEM rather than Domain Users)
to give the user a hint? How is this handled on other ACL systems? (I
can check next week.)

Thomas

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple