X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:in-reply-to:references:date
	:message-id:subject:from:to:content-type; q=dns; s=default; b=Bo
	vKSHUWkhNaMXcEEoHsDcCSVawBZOY2cywrJf2okBgeJHIyFA+GaPyjl4AYlXHRur
	r3LdGqaF3ktIOCph7j7OFllaKNDNvI6WaIXi/66CcAGSg9svC7MKbQzbXfFQcgf/
	l6vdxk18tvYGOp/QdDwdVlY4hReZyJUjBwtUbCQtk=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:in-reply-to:references:date
	:message-id:subject:from:to:content-type; s=default; bh=PgkAVV93
	8Rf+3Fiis+//AodCfOs=; b=cW52NBVuoVxMJl8Bb7X7ZpsQtk/WbVpPXrd37V+Z
	Mc9c0ubQ81RFxE+YTzqEUJGMKnVjvd2gmOxde5mF3vRvx5GazWoW0b8gpeLGSHu3
	euPVf+Na8VbQilzN1HmWq6mHZITrQd+7jtvkSanMvXgznqULVppFBCngpzBz5TUn
	Uxg=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-0.3 required=5.0 tests=AWL,BAYES_05,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2
X-HELO: mail-wi0-f182.google.com
MIME-Version: 1.0
X-Received: by 10.180.74.39 with SMTP id q7mr8866370wiv.30.1416076871799; Sat, 15 Nov 2014 10:41:11 -0800 (PST)
In-Reply-To: <546795E3.4090806@secure-endpoints.com>
References: <81578012-FD3F-4463-BC56-ADB092317DD4 AT etr-usa DOT com>	<CABa6CEkRV=3FY6ZVGrdt--rH3PppwCJRD5poU0L2knv2k2ce_w AT mail DOT gmail DOT com>	<25F385A9-3E2D-44FC-998F-D2672F67DFE4 AT etr-usa DOT com>	<m40npq$vrq$1 AT ger DOT gmane DOT org>	<ECD073FF-B78C-4D19-8DE1-5F4E390D2495 AT etr-usa DOT com>	<20141113093335 DOT GI2782 AT calimero DOT vinschen DOT de>	<40005E53-A327-4E4A-8C71-514E505F9FBC AT etr-usa DOT com>	<CAD8GWstJ+BkbkCJfE_48=b2cg0uzc8pkd1UnevP6-=3DHL+Buw AT mail DOT gmail DOT com>	<546795E3 DOT 4090806 AT secure-endpoints DOT com>
Date: Sat, 15 Nov 2014 13:41:11 -0500
Message-ID: <CAD8GWss-DSbSNwW6tZTa+nRWpe3LGk-GD5dr7F2Bqhymgw8VXA@mail.gmail.com>
Subject: Re: /usr/local, /var and */tmp in c:\Users\Public
From: Lee <ler762 AT gmail DOT com>
To: cygwin AT cygwin DOT com
Content-Type: text/plain; charset=ISO-8859-1
X-IsSubscribed: yes

On 11/15/14, Jeffrey Altman <jaltman AT secure-endpoints DOT com> wrote:
> On 11/15/2014 12:55 PM, Lee wrote:
>
>>> So, just because I installed Cygwin with my regular user account,
>>
>> You're doing it wrong.  Install Cygwin using an admin account and
>> regular user accounts are not allowed write access to system
>> files/directories:
>
> This feels really wrong to me.  If installing Cygwin under a non-admin
> account results in a potential security vulnerability, then the
> installer should be taking that into account.

I would argue that no, the installer should _not_ take that into
account.  If someone wants to install cygwin under their regular
userid, why should the installer try to work around that?  The files
are installed with the "correct" permissions if the windows admin has
an administrator account for doing admin chores & a regular user
account for doing day to day user tasks.


>  Applications that behave
> differently depending upon how they are installed

It's the file permissions that are different.  As far as I can tell,
cygwin behaves the same when installed by a user for the current user
& when installed as an admin for all users.

> should have in the
> installer an option for
>
>  * install for all users (requires administrator)
>
>  * install for the current user

Which the cygwin installer does do.  It's up to the user that wants
the more secure file permissions to install cygwin using an admin
account & have another account for normal day to day use.

Best Regards,
Lee


> Where install for current user installs the application configured so
> that the current user account (and not others) can use it.
>
> Just my two cents.
>
> Jeffrey Altman
>
>
>

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple