X-Recipient: archive-cygwin AT delorie DOT com DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:references:date:in-reply-to :message-id:mime-version:content-type; q=dns; s=default; b=JIeTv 4M0QYzcnmXuwDvo287d3mOoO3L+x0pJf0ayIcRb54k9EdPj1AQehKUe50Lwbdet/ Zjrk/I4tcNg/IN0AUPdpaasd/0BF+UAFZ6IQ7wtu2yR0toNLtC6rEMW4RXGs2uAp vWMT+eQr7IxsU2UAo6dqFWBALceSS1xepmJ+Ok= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:references:date:in-reply-to :message-id:mime-version:content-type; s=default; bh=kaQybqQvIS0 CuwT0SVExFDT5F94=; b=u10EVYIMYVeOLQ54M0AOBJFFT+krQ6xjoP0T+QNZASO MXVdu2pSebbuEIbQlDkq8IVNVw3YAKkynU2nEN+d6ml+cGdtCqMiYxULxbeNTNjF f7I0ZJQuev7Wivh+kzpPC+DLmofoc6PUtksAxU9nQHx3Z1mw/Q73pnpLrUV8Sr5k = Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com Delivered-To: mailing list cygwin AT cygwin DOT com Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-2.0 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2 X-HELO: mail-in-02.arcor-online.net X-DKIM: Sendmail DKIM Filter v2.8.2 mail-in-14.arcor-online.net 3msb283YTLz90HB From: Achim Gratz To: cygwin AT cygwin DOT com Subject: Re: Shares with strange ACL settings References: <20150812152601 DOT GL13029 AT calimero DOT vinschen DOT de> <20150812155817 DOT GN13029 AT calimero DOT vinschen DOT de> <878u9g9y6b DOT fsf AT Rainer DOT invalid> <20150812183220 DOT GO13029 AT calimero DOT vinschen DOT de> <87vbck8h92 DOT fsf AT Rainer DOT invalid> <20150813163302 DOT GB28349 AT calimero DOT vinschen DOT de> Date: Thu, 13 Aug 2015 19:47:08 +0200 In-Reply-To: <20150813163302.GB28349@calimero.vinschen.de> (Corinna Vinschen's message of "Thu, 13 Aug 2015 18:33:02 +0200") Message-ID: <87egj7w06b.fsf@Rainer.invalid> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.0.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Note-from-DJ: This may be spam Corinna Vinschen writes: > This puzzles me a bit. As example you gave something like > > ----rwx---+ gratz Domain Users [...] foo > > Given the code in recent Cygwin versions, this shouldn't happen if the > user gratz is member of the Domain Users group. The current code > doesn't test all groups in the ACL, only the primary group, but that's > sufficient in most cases. I've detailed the setup in an earlier post (with getfacl and icacls output) that I can't dig out shortly, but the setup is, in a nutshell: The share access is purely governed by two access groups, one that gives you the right to read and another one that lets you create and change things. You'll be in one or both of these groups in AD. All ACL are inherited from the root of the share down and the right to change the DACL (and thus remove that inheritance) is explicitly forbidden for anybody. The actual setup is a bit more complicated, with additional groups that ensure that share administrators can do what they need to do and that the backup can actually be done, etc.pp. > So this could only happen if you modify the permissions of windows files > using Cygwin tools and Cygwin helpfully gernerates a DENY ACE for the > owner. No, the owner just never gets the full access it would need to do this. For a while they didn't even let you look at the DACL, but at least that part of the silliness has been fixed. > I'm just not exactly sure about the way to go to get these permissions > in a non-artificial scenario. But I can reproduce it like this: > > - The file xxx has a primary group different from the group which has > permissions, e.g.: > > owner: foo > pgroup: foo_group > > acl: 1 entry > bar_group: full control > > - ls -l xxx > ----rwx---+ 1 foo foo_group 68565 Aug 10 10:37 xxx > > - $ chmod g-w xxx The chmod, if you try to run it, never succeeds. That's the crux of this setup, anything will always have just rwx for the group via ACL and you can't change that. > So, what's going on here and how do we really fix it? It *might* be > prudent to drop any efforts to create DENY ACEs to reflect the POSIX > perms. That results in the documented permission gap between POSIX and > Windows permissions, though. There's just no way to express all possible > POSIX permissions using Windows ALLOW ACEs only. There aren't any deny ACL, you just don't get the right to play with the permissions to start with. FOr Windows it doesn't matter that the owner hasn't got any access rights as long as she's in a group that has. POSIX doesn't even look at the group/ACL if it the owner bits are cleared. Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ Waldorf MIDI Implementation & additional documentation: http://Synth.Stromeko.net/Downloads.html#WaldorfDocs -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple