DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org BEF8D3858D28
Date: Mon, 10 Jan 2022 14:46:26 +0100
From: Corinna Vinschen <corinna-cygwin@cygwin.com>
To: cygwin@cygwin.com
Subject: Re: Duplicate ACLs? - Can't copy file even with Admin permissions
Message-ID: <Ydw4stFxX+he1A6b@calimero.vinschen.de>
Mail-Followup-To: cygwin@cygwin.com
References: <25043.7019.643488.389876@consult.pretender>
 <YdWCPsZOModGdRXM@calimero.vinschen.de>
 <8735m12k3u.fsf@Rainer.invalid>
 <25047.23325.33020.646017@consult.pretender>
 <25048.43238.484068.737126@consult.pretender>
 <YdwFc2JA5FfH1Ktr@calimero.vinschen.de>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <YdwFc2JA5FfH1Ktr@calimero.vinschen.de>
Precedence: list
Reply-To: cygwin@cygwin.com
Content-Type: text/plain; charset="utf-8"
Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>
Content-Transfer-Encoding: 8bit

On Jan 10 11:07, Corinna Vinschen wrote:
> On Jan  7 15:56, cygwin@kosowsky.org wrote:
> > > Corinna Vinschen wrote:
> > > On Jan  6 16:11, cyg...@kosowsky.org wrote:
> > > It is.  I realized belatedly, that 3da9e136.acl is apparently a
> > > directory, not a file.
> > 
> > It's actually a file...
> 
> This is weird.  The meaning of the OI and CI markers are "Object
> inheritance" and "Container inheritance".  These bits only make sense
> for directories and they control how ACEs are inherited by child objects
> (files) and child containers (subdirs).
> 
> Consequentially, if I use `icacls /restore' on a file with the DACL
> saved by you, the OI and CI bits are simply ignored.  After /restore,
> if I call /save again the resulting file looks like this:
> 
>   $ cat aclfile-after-restore.sav
>   acltest
>   D:PAI(A;;FA;;;SY)(A;;0x1200a9;;;WD)(A;;FA;;;BA)

FTR, it's even worse.  Windows ACEs with inheritence flags result in
equivalent POSIX default ACEs.  Per Linux (or better, POSIX 1003.1e
draft 17), it's an error trying to set default ACEs on files.
Therefore, a process trying to set the permissions as in your case
would result in getting errno EACCES.  Cygwin follows suit.

> However, this gave me a clue.  If this is really a file, it's a good
> chance that the inheritance flags are restricted to directories at
> one point in either the Cygwin DLL itself, or the getfacl tool.
> 
> I'll have a look into the sources later, but I sure would prefer if
> I could create such a file locally.

I tried to create a file with equivalent ACL including the inheritence
flags on W7, W10 and W11, but to no avail.  After running icacls
/restore the resulting DACL does not contain inheritance flags on none
of the systems.  Neither do the different Windows GUIs allow setting
inheritance flags on files.

I also ran getfacl under GDB and manipulated getfacl into believing that
a directory with matching ACL is actually a file, but the output generated
by getfacl was not showing the default ACEs at all:

  # file: acltest
  # owner: Administrators
  # group: SYSTEM
  user::rwx
  group::rwx
  other::r-x


¯\_(ツ)_/¯
Corinna

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple