X-Recipient: archive-cygwin AT delorie DOT com
X-Spam-Check-By: sourceware.org
Date: Thu, 7 Aug 2008 10:14:05 +0200
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: CSIH file permission tests on non-NTFS broken (was Re: 	ssh-host-config   script fails)
Message-ID: <20080807081405.GB30629@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <2B02F35EEE21064E9EF7F377F7F37D7402949615 AT ADMAIL01 DOT ICSDMN DOT local> <20080723163450 DOT GY5251 AT calimero DOT vinschen DOT de> <20080724092249 DOT GC28166 AT calimero DOT vinschen DOT de> <20080730124957 DOT GN29031 AT calimero DOT vinschen DOT de> <48914567 DOT 3010100 AT cwilson DOT fastmail DOT fm> <20080731075001 DOT GA22385 AT calimero DOT vinschen DOT de> <4897A422 DOT 4040405 AT cwilson DOT fastmail DOT fm>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4897A422.4040405@cwilson.fastmail.fm>
User-Agent: Mutt/1.5.16 (2007-06-09)
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

On Aug  4 20:51, Charles Wilson wrote:
> Corinna Vinschen wrote:
>> A check for non-NTFS should be sufficient for now, IMHO.  It's bad
>> enough to run an OS on such an insecure file system, but it's hard to
>> enforce upgrading to NTFS.  However, ntsec and smbntsec are dead in the
>> water and I don't think we should encourage usage of noacl more than
>> necessary, especially for sensitive services.
>
> So, I'd basically need to check the fstype for each of the directories of 
> interest (they MAY all be on the same volume, but not necessarily).
>    /var
>    /var/run
>    /var/log
>    /var/empty
>    /etc
> So, how do I do that portably?  The 1.7 version of mount returns that 
> information, but the 1.5 version does not.  What if I import your 

Oh, right.

> getvolinfo program
>   http://cygwin.com/ml/cygwin/2007-08/msg00040.html
> as one of the csih helper progs, and put it under /usr/lib/csih/ 
> (alternatively, import getvolinfo into cygutils).
>
> In that case, I wouldn't need to check for NTFS at all -- instead, I'd 
> check for "FILE_PERSISTENT_ACLS[ ]*: TRUE", right?

Sounds like a good idea to me.  OTOH, whatever you test, you might not
cover all situations.  What about letting the user override the test?


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/