DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 4ABDaHeQ3815788
Date: Mon, 11 Nov 2024 14:35:55 +0100
To: cygwin@cygwin.com
Subject: Re: SMBFS mount's file cannot be made executable
Message-ID: <ZzIIO2NxmdYpox2A@calimero.vinschen.de>
Mail-Followup-To: cygwin@cygwin.com
References: <BL0PR0901MB430827F1A0668E468B498FBBA5D70@BL0PR0901MB4308.namprd09.prod.outlook.com>
 <20241108205109.55f99e2d172b9fc87e92ae67@nifty.ne.jp>
 <Zy4ODHHpmZPggGSz@calimero.vinschen.de>
 <20241111193152.c3a81044a03ecf2093185166@nifty.ne.jp>
 <ZzHizX_6FXABDPvZ@calimero.vinschen.de>
 <20241111201928.811a2f8f09142b7aa8fe9bdc@nifty.ne.jp>
 <20241111203202.b22bcf4f9030aff58299fe0e@nifty.ne.jp>
 <20241111204051.493f12208bb59d62b699dd28@nifty.ne.jp>
 <ZzHyhoWnNvkTQYW-@calimero.vinschen.de>
 <20241111211953.605b186566ce3a44ca929788@nifty.ne.jp>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <20241111211953.605b186566ce3a44ca929788@nifty.ne.jp>
Precedence: list
From: Corinna Vinschen via Cygwin <cygwin@cygwin.com>
Reply-To: cygwin@cygwin.com
Cc: Corinna Vinschen <corinna-cygwin@cygwin.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces~archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>

On Nov 11 21:19, Takashi Yano via Cygwin wrote:
> On Mon, 11 Nov 2024 13:03:18 +0100
> Corinna Vinschen wrote:
> > On Nov 11 20:40, Takashi Yano via Cygwin wrote:
> > > On Mon, 11 Nov 2024 20:32:02 +0900
> > > Takashi Yano via Cygwin <cygwin@cygwin.com> wrote:
> > > > Even with this patch, the file:
> > > > 
> > > > yano $ touch samba_test_file.txt
> > > > yano $ ls -l samba_test_files.txt
> > > > -rw-r--r-- 1 yano yano 0 Nov 11 20:25 samba_test_file.txt
> > > 
> > > Oops! This was wrong.
> > > -rw-r--r-- 1 Unknown+User Unix_Group+1000 0 Nov 11 20:25 samba_test_file.txt
> > 
> > That's Samba for you.  I applied your patch and created a file
> > on my share, and the Authenticated Users group was not in the
> > resulting ACL.  Only user, group, and Everyone.
> > 
> > Either way, I don't think this is the right thing to do.  Even if
> > the group isn't added to the ACL on my machine, it still loks like
> > a security problem in waiting.
> 
> Isn't this DACL here used only for access_check() (NtAccessCheck())?
> In my environment, the Authenticated Users does not appear in the ACL
> too.

Oh, yeah, right, *blush*.

But it's still not the right thing to do.  You convert the Samba ACL
to a Windows ACL which gives Authenticated Users full permissions.
So the check_access() function will return false positives, because
every authenticated user is in the Authenticated Users group and has
supposedly FILE_ALL_ACCESS.  Even if the actual function (read, write,
execute) will fail, the access() function will claim that every
authenticated user has RWX perms.

AFAICS, the underlying problem is somehow the user mapping.  Did you
try with username map = /foo/bar?


Corinna

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple