X-Recipient: archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status: No, hits=1.3 required=5.0 	tests=AWL,BAYES_00,BOTNET,J_CHICKENPOX_64
X-Spam-Check-By: sourceware.org
Date: Wed, 31 Dec 2008 16:56:33 -0800
From: David Rothenberger <daveroth AT acm DOT org>
Subject: Re: [BUG 1.7] Read-only files are not.
In-reply-to: <loom.20090101T000200-655@post.gmane.org>
To: cygwin AT cygwin DOT com
Message-id: <495C14C1.3090906@acm.org>
MIME-version: 1.0
Content-type: text/plain; charset=ISO-8859-1; format=flowed
Content-transfer-encoding: 7bit
References: <495C00DF DOT 5020208 AT acm DOT org> <loom DOT 20090101T000200-655 AT post DOT gmane DOT org>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.19)  Gecko/20081209 Thunderbird/2.0.0.19 Mnenhy/0.7.5.666
X-IsSubscribed: yes
Reply-To: cygwin AT cygwin DOT com
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

On 12/31/2008 4:06 PM, Eric Blake wrote:
> David Rothenberger <daveroth <at> acm.org> writes:
> 
>> It seems that read-only files in Cygwin 1.7 are not truly
>> read-only.
> 
> Are you perchance running as an Administrator, and therefore you have backup 
> privileges?

Yes.

> If so, then you have root-like power, and cygwin exposes that by 
> opening files with intent to backup even when the ACLs would otherwise make the 
> file unreadable.  Therefore, even though none of S_IRUSR, S_IRGRP, S_IROTH are 
> set in the posixy st_mode bits, access(file, R_OK) returns 0 and open() is able 
> to exploit your root-like powers to read that file.
> 
> I thought Corinna mentioned this in the release notes.

I didn't see anything mentioned in this message: 
http://cygwin.com/ml/cygwin-announce/2008-12/msg00009.html

>> (This issue was brought to my attention by a failing subversion test
>> after building for 1.7.)
> 
> The findutils testsuite also had to make accomodations to skip certain tests 
> when run with root-like privileges.

If this is indeed intended behavior, I will adjust the subversion test 
cases accordingly.


-- 
David Rothenberger  ----  daveroth AT acm DOT org

pain, n.:
         One thing, at least it proves that you're alive!


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/