DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:references:date:in-reply-to
	:message-id:mime-version:content-type; q=dns; s=default; b=Ms8gr
	HglSwE5k3VntPaNj5i+12ScP2f4V7/Nq2WfDlOLoljx0GeZl8+xILv7BOfQN2nKc
	8e3QVwA0wYEOlhzSPM/gTmAaaV/MFIXd2RxXSL7sTLcFtyMWn1xu6cgeNDdgAp12
	EJQ+TzQAVzEXyFeJuxEOcJfv7sSWozkf/ozsnY=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
From: Achim Gratz <Stromeko@nexgo.de>
To: cygwin@cygwin.com
Subject: Re: Shares with strange ACL settings
References: <20150812152601.GL13029@calimero.vinschen.de>	<loom.20150812T172703-7@post.gmane.org>	<20150812155817.GN13029@calimero.vinschen.de>	<878u9g9y6b.fsf@Rainer.invalid>	<20150812183220.GO13029@calimero.vinschen.de>	<87vbck8h92.fsf@Rainer.invalid>	<20150813163302.GB28349@calimero.vinschen.de>	<20150813175302.GD28349@calimero.vinschen.de>	<20150814082959.GE28349@calimero.vinschen.de>	<loom.20150814T125223-728@post.gmane.org>	<20150814134552.GG28349@calimero.vinschen.de>
Date: Fri, 14 Aug 2015 20:25:11 +0200
In-Reply-To: <20150814134552.GG28349@calimero.vinschen.de> (Corinna Vinschen's	message of "Fri, 14 Aug 2015 15:45:52 +0200")
Message-ID: <87fv3l683c.fsf@Rainer.invalid>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.0.50 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain

Corinna Vinschen writes:
> Cool, thanks for your quick feedback.

Thanks for the snapshot!

> We should just be aware that this is ultimately a kludge.  I think I now
> finally understand what would have to be done to get a generic solution
> which results in correct POSIX permission evaluation for any current
> user and any file ACL.  However, from some preliminary testing it seems
> the generic solution has at least two downsides:
>
> - It's slow (AuthZ code, setting up and breaking down user/group contexts
>   for each checked file...)
>
> - It would always contact the AD when trying to fetch info for AD users,
>   which is bad for remote machines not or slowly connected to the AD server.

I think we've came to the same conclusion (modulo the question of
whether AuthZ would be usable for this) some time ago.  My personal take
on this is that the "kludge" is likely better than both what we had
before and the result of the pre-snapshot ACL evaluation.  If that also
solves the problem of denying oneself file access by simply copying a
file with carefully crafted ACL, then I would say it's good enough for
most circumstances.  Probably not good enough to pass the Perl filemode
tests during build, but they have some problems in their design anyway.

> Anyway, this isn't pressing so it would be nice if you keep on
> testing.

As I said, I need some time next week to switch things into a mode where
problems could potentially show up.  I don't expect any, but I don't
pretend to understand all the edge cases completely either.

> I'm planning to update to 2.2.1 only after a certain pipe problem just
> discussed on the #cygwin IRC channel is either fixed or settled any
> other way, 
>
> Btw., can you please also check /proc/cpuinfo?

Yes, I have both AMD and Intel machines I can test this with.

> As discussed, Cygwin's emulation fell short on L3 cache info.  I now
> added code to fetch L3 cache info as well as correct processor topology
> information on Intel CPUs.  For AMD CPUs the topology and cache
> info was already fine.  Linux does not show L3 cache info for AMD CPUs
> afaics, so I also didn't add that to Cygwin.

I can't test this with a new enough kernel for AMD, but perhaps someone
is testing some new iron/OS combination and I can get that information
from them.  For Intel since some time the L3 cache size is shown (older
kernels would show you the per-node L2 cache size IIRC).


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

SD adaptation for Waldorf Blofeld V1.15B11:
http://Synth.Stromeko.net/Downloads.html#WaldorfSDada

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple