DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=AuHvvKKdhd07mZYUpqSobwxRFB+Rk3jhjdJokzG3XoMk/2j+Zqyop
	lZgKenYsHramjayyCtnvlES8JNMyjoCTzUPLxB1cQPEJ+5y4rIzJgmfSTDjaLX9f
	Y65ymOjakeZfNxYNQZbaB24YkylUlRjS/fz5knPpSv4gC8Xtl1reP0=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Date: Mon, 13 Oct 2014 10:07:25 +0200
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: Necessary To Query SACL Information?
Message-ID: <20141013080725.GY2681@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <CADi7v6J5xOcDuv=4aODLswMBSDLaAcNXs5yCM=WBsqbsrLV+zg AT mail DOT gmail DOT com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;	protocol="application/pgp-signature"; boundary="pP0ycGQONqsnqIMP"
Content-Disposition: inline
In-Reply-To: <CADi7v6J5xOcDuv=4aODLswMBSDLaAcNXs5yCM=WBsqbsrLV+zg@mail.gmail.com>
User-Agent: Mutt/1.5.23 (2014-03-12)

--pP0ycGQONqsnqIMP
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Oct 12 20:37, Bryan Berns wrote:
> I noticed when I launch an executable, Cygwin queries SACL information
> on the executable (which I can see in Process Monitor as a
> 'QuerySecurityFile' operation).  On some of my protected file servers,
> this generates a failure audit.  Looking at the source code, I'm going
> to guess this might be from the NtQuerySecurityObject call in
> security.cc which requests SACL information by asking for for
> ALL_SECURITY_INFORMATION.  Does Cygwin really need to query this
> information? Aside from keeping my audit logs clean, it seems like it
> might be an opportunity for optimizing the executable launch process
> if Cygwin doesn't really need this (or some of the other information
> that ALL_SECURITY_INFORMATION provides).

As you found out yourself, Cygwin only reads and writes the owner/group
information and the DACL.  Accessing this information is required for
POSIX permission handling, e.g. stat(2), chmod(2), chown(2), acl(2).
Also, creating a file with open(2) requires to write the DACL to create
valid POSIX permissions for a file.


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--pP0ycGQONqsnqIMP
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJUO4g9AAoJEPU2Bp2uRE+gkMIP/0plEUxqVmtHySmU8ZNmYp4S
ff9seDcivQ33OmqZJzsNlBttedRgTQ1fB+9zY4RYBJujA51dGKhRhNHWhoaznqai
AMlkeEiy1cVBBDvv12/Y4CkfjiWQjzcPHIiVGkLt2OEmPKKw/Xk6e3RvKlEMUGTW
bYqq5DX5ecb/s+42kMWAog1L2j8ovVb2ANJJWv9bQ49FUmeQMstjl+oMO4EKfbBL
FhQvtTpgju1eAm/xrzYTA1QBtpiU+fvn/tpW/wCiW5gmPHlvVhgoESQ+bd+f2Xi6
zHAcunhqTkQxlL+ud3tX9vmgD+nUm+YJ0Ydcd4Hypifgo30BYTvAl6VAq+OTtNXW
tdfSHo3hWvDwkGpAvmi3EIL4WopmbUy+fcQ/kh2Og50zYBKNiQE2/snCkSgCBrFi
sebSduLJ91ODWHgppGxreWvTIMluiVVz6z/g1zJbe41k3gVxxRJxB+nRkwaY482d
c84VRzbBvhOXryP5JYy0VRh1oNzbpMycoXeTlhHS/x3K6dZ0mZ8nAYfNRUSxQgRM
yr16yrGPq5EqbDJk/gcVy42SjEvCgEfR9cFfVh76iKZtvBpUtKNCopP1bZs5Ccl3
H5oIJwy29k7X3p2/N0O5KXXKGuLvBPwm1+Ff4RNECUFbULsIUe23mwXLiHtiReK4
dzRE4clgyN+TTdu3VNrd
=gOlA
-----END PGP SIGNATURE-----

--pP0ycGQONqsnqIMP--