DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=yk4c4A9+oJEYTWsHV2Pz0HPrLv0SVWhgWMKbufp2tCIa6b0QPCySt
	LvFVTeZjYNqV+/3Z+FIMYzvQ+6eajlFc9kFvJV6Nsgh7K86U415/qpzveHk9bCIC
	qyjGaaZyN2xwbgjVq7oovZDcvFwpMkQBkJvvCDuPws6vu55IVPwVwI=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Date: Mon, 27 Aug 2018 12:50:31 +0200
From: Corinna Vinschen <corinna-cygwin@cygwin.com>
To: cygwin@cygwin.com
Subject: Re: incompat in cygwin choice of using '+' as domain and user separator.
Message-ID: <20180827105031.GF4733@calimero.vinschen.de>
Reply-To: cygwin@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
References: <5B7DE56E.6060109@tlinx.org> <20180823081135.GN3348@calimero.vinschen.de> <5B8370CA.5080209@tlinx.org> <20180827090909.GA4733@calimero.vinschen.de> <20180827104152.GC4733@calimero.vinschen.de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;	protocol="application/pgp-signature"; boundary="qp4W5+cUSnZs0RIF"
Content-Disposition: inline
In-Reply-To: <20180827104152.GC4733@calimero.vinschen.de>
User-Agent: Mutt/1.9.2 (2017-12-15)

--qp4W5+cUSnZs0RIF
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Aug 27 12:41, Corinna Vinschen wrote:
> On Aug 27 11:09, Corinna Vinschen wrote:
> > On Aug 26 20:32, L A Walsh wrote:
> > > On 8/23/2018 1:11 AM, Corinna Vinschen wrote:
> > > ...
> > > > No, that's a wrong assumption.  Think about it.  The ACL given to
> > > > acl_to_text is the binary form, so it doesn't contain user or group
> > > > names, only uids and gids.  The usernames are only generated in the
> > > > output.
> > > ---
> > > 	Rats.  Of course, you're right.  	Then I nominate the problem being =
that it
> > > can't convert from domain "Unknown"-user + "Unknown"-group to somethi=
ng it
> > > can store in tar.
> >=20
> > The problem with unknown SIDs is that there's no bijective
> > transformation between SID <-> uid/gid.  You get the uid/gid -1 and
> > then... what?  How do you restore the information?  There's no SID for
> > uid/gid -1.
> >=20
> > > As far as duplication, I have /etc/passwd+/etc/group files that mirro=
r my
> > > accounts on the linux-based PDC (samba 3.x).
> >=20
> > What for?  This should work automatically and you would get rid of those
> > dreaded backslashes in the account names.  Using passwd/group files also
> > have a higher probability of account overlap with weird results.
> >=20
> > Passwd and group files should only be used if you have very specific
> > problems to solve (like offline usage or see below), otherwise just use
> > the values you get from the account DBs.
> >=20
> > > In this case, that user+group appear to correspond
> > > to non-existent users. (S-1-5-21-oldsystem-ID-1001 + -1005).
> > > The domain/system part appears to be from some previous
> > > value for the machine's "sid"?  Not sure how to deliberately
> > > reproduce that, but maybe you have a tool to create an
> > > invalid acl entry for a user like: Unknown+User:*:4294967295:42949672=
95:S-1-5-21-3457732827-2369206082-2151550420-1001
> > > in /etc/passwd.
> > > and something similar in /etc/group?
>=20
> Actually, I just did that.  I added a user and a group to the files with
> weird SIDs, then I switched /etc/nsswitch.conf to "db" only.  With
> different ACLs (created by Cygwin, created by native Windows) there are
> different results.  The problem is that uid/gid -1 can be created as a
> file ACL entry *and* at the same time have the meaning of "don't look
> for the uid/gid" when checking the ACL for validity.  To make matters
> worse, if you have multiple ACEs of unknown users, the resulting ACL is
> *always* invalid.
>=20
> Bottom line is, there are at least two bugs here in Cygwin.  I'm looking
> into a fix.

The only sane way to handle unknown SIDs in file ACLs is to ignore them
entirely.  The result will be that you never see them in getfacl, nor
will they be stored by tar or rsync.  They are just not there from the
Cygwin perspective.


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--qp4W5+cUSnZs0RIF
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEoVYPmneWZnwT6kwF9TYGna5ET6AFAluD13YACgkQ9TYGna5E
T6B6bg/+Jws32yzzOtmKGJ5FqFUb4OIIrC7vovdHg+4xxgdwAySOmGHHe9e1ORZJ
wwfXHYZ9+hx/QNiowC12bacqUqhSAbOLsqshdTIsQWuMRqGeK4CnFth1odFfV09q
bqcESG69gezoYdZaXc+FIdljqO1zVSV0fsvGD3dI/tQAnGbkYW3OhY116NQ+oAFB
whWz4WHQjgHUPBJmpukZ9OQiTlWJV2h0UnN6yzsB5XgZx9+H7gtbjpiWGH2lYNCL
OBJY+FxL6CNxG5C3FgCwmjgUHxKMyOzYAZ8TRMUZiPCPkNxQbT3/cCHyOaG/nE0Z
z4iqKy4I1qymTq7JI4BYqxOgqSwD7/752eVOYhKvz3+DWr/p/IaLJ7iZ/b1RLA8B
FpIQritptkl3AMM27lr68rNeD/bsE//ThZ8yET/WYXQFQYn+peB4mrjAwVcmAjcM
CdfuPh/W+R066TIQicU26QYgEJfFnvkC+DkieUSqJ6Mj4/MDDsi2ZsFzfiQCErPm
V1wTXeJKeVYh/OKnXRPHzsgONv2xOFjPp4w9zTiE2i6YN03uN8jEMvLJitCD/vev
Cl82E8dPY6ewfAzgXiFEDeHaKPxrAoIMM+qMfqjH2lmJ429zEnfHMOUpzgsUYoYY
91BlGZbsjwmDIjmbGdPJQpd2JQnbmL9CmcxoypKA33gMGClnoJ0=
=lct/
-----END PGP SIGNATURE-----

--qp4W5+cUSnZs0RIF--