DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 4ABBWaTv3786361
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org BD9653858D21
Date: Mon, 11 Nov 2024 20:32:02 +0900
To: cygwin@cygwin.com
Subject: Re: SMBFS mount's file cannot be made executable
Message-Id: <20241111203202.b22bcf4f9030aff58299fe0e@nifty.ne.jp>
In-Reply-To: <20241111201928.811a2f8f09142b7aa8fe9bdc@nifty.ne.jp>
References: <BL0PR0901MB430827F1A0668E468B498FBBA5D70@BL0PR0901MB4308.namprd09.prod.outlook.com>
 <20241108205109.55f99e2d172b9fc87e92ae67@nifty.ne.jp>
 <Zy4ODHHpmZPggGSz@calimero.vinschen.de>
 <20241111193152.c3a81044a03ecf2093185166@nifty.ne.jp>
 <ZzHizX_6FXABDPvZ@calimero.vinschen.de>
 <20241111201928.811a2f8f09142b7aa8fe9bdc@nifty.ne.jp>
Mime-Version: 1.0
Precedence: list
From: Takashi Yano via Cygwin <cygwin@cygwin.com>
Reply-To: Takashi Yano <takashi.yano@nifty.ne.jp>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces~archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>

On Mon, 11 Nov 2024 20:19:28 +0900
Takashi Yano via Cygwin <cygwin@cygwin.com> wrote:
> On Mon, 11 Nov 2024 11:56:13 +0100
> Corinna Vinschen wrote:
> > > diff --git a/winsup/cygwin/sec/base.cc b/winsup/cygwin/sec/base.cc
> > > index d5e39d281..c519af6e0 100644
> > > --- a/winsup/cygwin/sec/base.cc
> > > +++ b/winsup/cygwin/sec/base.cc
> > > @@ -681,6 +681,9 @@ convert_samba_sd (security_descriptor &sd_ret)
> > >  				     ace->Header.AceFlags))
> > >  	  return;
> > >        }
> > > +  /* Samba without AD seems to need this. */
> > > +  add_access_allowed_ace (acl, FILE_ALL_ACCESS,
> > > +			  well_known_authenticated_users_sid, acl_len, 0);
> > >    acl->AclSize = acl_len;
> > >  
> > >    RtlCreateSecurityDescriptor (&sd, SECURITY_DESCRIPTOR_REVISION);
> > > 
> > > What do you think?
> > 
> > Giving all authenticated users full permissions to all your files?
> > Unconditionally?  That sounds like opening a security hole wide open.
> 
> Does this really mean such thing? Windows 11 share reports here,
> access mask 0x001201bf for S-1-5-11 is granted. Isn't this simillar?

Even with this patch, the file:

yano $ touch samba_test_file.txt
yano $ ls -l samba_test_files.txt
-rw-r--r-- 1 yano yano 0 Nov 11 20:25 samba_test_file.txt

cannot be written by other users:

someone $ echo BBBB > samba_test_files.txt
samba_test_files.txt: Permission denied.

-- 
Takashi Yano <takashi.yano@nifty.ne.jp>

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple