DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:reply-to:mime-version:to
	:subject:references:in-reply-to:content-type
	:content-transfer-encoding; q=dns; s=default; b=GWTm+yr3V2S8/h21
	IaStSkatbMjp9RvEOXI1j9LVFtelzpjJwQcE3wpnjUSvyJuBN/Ol0OEs86Bp1p9i
	IL2lJM41Mmk3VTHVK720382fsgVakuE0cdEiUKRgp6uy4t2th/XfoMb0o5CiaUEr
	owzQhFNeNkHPesj/5i0ow6Dnw8I=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Message-ID: <551B3EA8.4050607@cs.umass.edu>
Date: Tue, 31 Mar 2015 20:41:12 -0400
From: Eliot Moss <moss@cs.umass.edu>
Reply-To: moss@cs.umass.edu
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0
MIME-Version: 1.0
To: cygwin@cygwin.com
Subject: Re: More about permissions
References: <551A13D8.1030701@cs.umass.edu> <20150331101534.GE32403@calimero.vinschen.de>   <551A9149.4020408@cs.umass.edu> <1837571490.20150331235503@yandex.ru>
In-Reply-To: <1837571490.20150331235503@yandex.ru>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit

On 3/31/2015 4:55 PM, Andrey Repin wrote:

 >> I am not sure this particular program (CrashPlan) works that way.
>
> That's not program property, but the user you run the program from.

Perhaps, but it runs as a background service.  I never explicitly said what
user it runs as, etc.

Looking in Services, I see is logs on as "Local System account".  Using
Process Explorer, it appears to run without SEBackup/Restore privileges.
Since the program has to request them itself as it runs, I don't see any
good way to fix this.

> I think i've explained it earlir, but here's it again:
> In POSIX model, root have implicit permissions.
> In Windows model, there NO implicit permissions at all. Everything should be
> explicitly assigned. I.e. SeBackupRestore privilege.
> If you deny SYSTEM access to a file, OS will not be able to do anything about
> it. Been there, blocked changes to cmd.exe when I was experimenting with 4NT.
> (And cmd.exe was in fact renamed 4nt.exe.) None of the Windows autotools were
> able to get around it.

Yes, I get that.  Hence my desire to grant SYSTEM:rwx on everything.

What we seem to have ended up with here, though, is that the
root privileges are explicit and are exposed in the ordinary permissions visible
with, say, ls -l.  This is not natural from a POSIX point of view (I claim);
otherwise, we'd more or less show access of rwxrwxrwx on everything in POSIX.

Now where this really makes a difference is when I am transferring files between my Windows
system and other systems that are Unix-based, using git, rsync, and such tools.
Either I remove SYSTEM access or the permissions get messed up.

>> Maybe what I am looking for is something like this:
>
>> - Certain Windows accounts/groups would be treated as 'root' for cygwin's
>>     purposes, perhaps controlled by a list in a file read when cygwin starts up.

> The list would be very short. "NT AUTHORITY\SYSTEM".

Ok -- I would be happy with that, rather than having g+rwx happening to every
file because I am granting SYSTEM access.

Do you begin to see the bind I feel myself in?

Regards -- Eliot

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple