DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:in-reply-to:references:date
	:message-id:mime-version:content-type:content-transfer-encoding;
	 q=dns; s=default; b=nqtMeLJHK0iZITzL6elxlBVvNcxbqtvWcVu661gjDKg
	j1KtCjMSfE/wg0UlnR21G1IL4/mRdeGFpoKn639QT4Lcu2x3sUpyFH+bkEazSkdu
	yLb/eBZ3qZrpFrs1V1f9c7vviGX18T5Gr5KPnoBgGI2RJ01NusePwm42qUBoEV50
	=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
From: Achim Gratz <Stromeko AT nexgo DOT de>
To: cygwin AT cygwin DOT com
Subject: Re: [TESTERS needed] New POSIX permission handling
In-Reply-To: <20150410100703.GA4401@calimero.vinschen.de> (Corinna Vinschen's	message of "Fri, 10 Apr 2015 12:07:03 +0200")
References: <20150410100703 DOT GA4401 AT calimero DOT vinschen DOT de>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.0.50 (gnu/linux)
Date: Sat, 11 Apr 2015 10:47:03 +0200
Message-ID: <87lhhzcarc.fsf@Rainer.invalid>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Corinna Vinschen writes:
> - To accommodate Windows default ACLs, the new code ignores SYSTEM and
>   Administrators group permissions when computing the MASK/CLASS_OBJ
>   permission mask on old ACLs, and it doesn't deny access to SYSTEM and
>   Administrators group based on the value of MASK/CLASS_OBJ when
>   creating the new ACLs.

Since you've now opened that can of worms of who is considered "root",
what about "Domain Administrators" or "Power Users", for starters?

>   That means, even if SYSTEM or Administrators have full access to the
>   file, the POSIX permssion bits will not reflect that fact.  And while
>   other users get access denied based on the mask value, SYSTEM and
>   Administrators will never get access denied based on the mask.

If you want to put this to better use in larger settings it would seem
preferrable if it was possible to define a list of users to treat this
way in fstab.  I think this would help with the braindead settings
NetApp filers are set up these days by default.  That generally means
that some domain group(s) need to be considered root on the share
depending on which share you are accessing.

> Apart from bugfixing the aforementioned code, there's still work to do
> on the getfacl and setfacl tools:

Sorry to pile another one on here: Currently it's not possible to use -k
and -b on the same invocation.  This works just fine on Linux.

Having the newer getfacl / setfacl from *BSD that deals with NFSv4 ACL
might be worth a shot, since at least superficially these seem to match
better to NTFS DACL in scope and would probably bring it more in line
with what icacls would show and do.  Before you ask, it has been duly
noted that NFSv4 ACL are somewhat incompatible with POSIX ACL in the
same way that NTFS DACL are… maybe some more info can be gleaned from
those documents:

http://users.suse.com/~agruen/acl/linux-acls/online/
http://users.suse.com/~agruen/nfs4acl/
http://www.ietf.org/archive/id/draft-ietf-nfsv4-acl-mapping-03.txt
http://www.bestbits.at/richacl/draft-gruenbacher-nfsv4-acls-in-posix-00.html
http://docs.oracle.com/cd/E23824_01/html/821-1448/gbacb.html


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Samples for the Waldorf Blofeld:
http://Synth.Stromeko.net/Downloads.html#BlofeldSamplesExtra

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple