X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=I4fNh9IdJCY6rqn6SDKXDTDiee0PUA7caovTunolfoCZHZq4cuXo8
	nOZt/Prx8ne75k/2X28ds8M29Lnb5fG/44j3SPoIfsxTjwrVkBuDuEHQB3JFHhQh
	swdECWJCHM5oq0rhsdiyS/o0Va2R9M3Tsv19nVZ/rngPQ/tQiZ5zBI=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	 bh=cjLFjFt1ZghZHRPM9AkPsEnjqyA=; b=lrDbu2fYqkOKCrx+S9Dq2zACbClJ
	Onp4ik/dde02QFkKzmsBD2LnS3GTiKFVtdnP520z1vIkAYrnqV8rX6f9/IR5RaOB
	DLR+BAbipKsYiUEYD2R17xzmy5/fbut4hjb0BhXiUqFdWHiZl27nsUQpQ9wBxTh1
	yJ1w1g5sy+8+oA0=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-4.1 required=5.0 tests=AWL,BAYES_50,KAM_LAZY_DOMAIN_SECURITY autolearn=no version=3.3.2
X-HELO: calimero.vinschen.de
Date: Tue, 14 Apr 2015 17:53:55 +0200
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: [ANNOUNCEMENT] TEST RELEASE: Cygwin 2.0.0-3
Message-ID: <20150414155355.GO7343@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <2bbd046b7e2ea40818416d8a6d3f15b8 DOT squirrel AT webmail DOT xs4all DOT nl> <20150414085757 DOT GC7343 AT calimero DOT vinschen DOT de> <loom DOT 20150414T162502-625 AT post DOT gmane DOT org> <20150414145212 DOT GG7343 AT calimero DOT vinschen DOT de> <loom DOT 20150414T173414-45 AT post DOT gmane DOT org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;	protocol="application/pgp-signature"; boundary="EecmvZxDifkbrwfl"
Content-Disposition: inline
In-Reply-To: <loom.20150414T173414-45@post.gmane.org>
User-Agent: Mutt/1.5.23 (2014-03-12)

--EecmvZxDifkbrwfl
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Apr 14 15:35, Achim Gratz wrote:
> Corinna Vinschen <corinna-cygwin <at> cygwin.com> writes:
> > Yes, perfectly normal and that already occured with older ACLs
> > created by Cygwin:
> >=20
> > https://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-files
> >=20
> > Don't reorder them.
>=20
> Ah, OK.  I must have been lucky not to encounter them so far.

The order is only supposed to become non-canonical if user(s)
have less permissions than group(s), and if group(s) have more
permissions than the MASK value and less permisssions than "other".
In these cases, DENY ACEs have to be generated to create an ACE which
fully supports POSIX permissions.

However, the DENY ACEs for groups must not precede the ALLOW ACEs for
USERs due to the way permissions are handled by the OS.  "Canonical"
ACLs just don't allow to fully express POSIX permissions.  It's a pity
that this arbitrary rule has been expressed, especially given that the
OS doesn't really care.  It handles the ACEs simply in order of
occurance.  There's also no good reason that the GUI wants to reorder,
except that Microsoft didn't implement a GUI which allows manual
ordering of ACEs.


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--EecmvZxDifkbrwfl
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBAgAGBQJVLTgTAAoJEPU2Bp2uRE+gtjUP/29v2ARr3dXBMtxQ/umaiHQ4
PSKyXB2XrE4hKgQUoQieOAU24OFFoyaFSBQf5xfkzyQBEEOqJ+diCkvldFXXJJdd
Cu0rtMbAFvRc1PBDvZ9Qh3AdnFlLLuO/1V5woD8rB9RLogWFebW4kC868oIjsKyC
c22kyBHGiehCcH8iw7rZpKtru3YEIIqN0197LsfDknr51NEZZyoQ2FxnaYFeP3T3
nS2zYYi5kNXzWmBKwt7Rehai7nE6BDDg8D4R1wd91yi7LuOS4V8vvz0ErvN/Cg4m
MY3S6abEOkwY5ojfcrQInIrHUJaabv2Wt/JOJzQTIB9lheVlSoXFcxXZ5j1wHQTb
qw+3q0Cgx/hg6kf0HttobL6pL9vX8w9mdhSu+rYVOochSI0J6+Sz1Ne87vO6BaCU
6+O9Dmcapz48aWt9fpNn96CXaxen2Zs5tvuTcRWOJnBr9O2UOk2mmTP66fK/Q/7K
5FPcazmgyUbgSpVxPB9vxIqjjrI+afRqUfECxGEsrwb6B592ad1bvYoDupXJ4MHF
R3FPoJRcxl1RydCInmDynDQee0YZWGFx3Vosu+18ieo/fKFO+nZBeuNT+qcFDnoj
7yTe/SNOZaxG6IvUfWjenSLVKHkVUTZp7VT3zSaFuUPqMTi+8bPG07gP3gwNbihG
GxLQ4SNTYGRPDOJAy8El
=rr6G
-----END PGP SIGNATURE-----

--EecmvZxDifkbrwfl--