X-Recipient: archive-cygwin AT delorie DOT com DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:references:date:in-reply-to :message-id:mime-version:content-type:content-transfer-encoding; q=dns; s=default; b=i8blZ5MwNyWPDmKVwebkvtc152kkbyOnkmQBYdMlnQx 9jLZepG8IV1MQMXNWtuyB9n0nHHjQMBJkGK07y7wXoucsX9Rk7Tf+gp/eHhLKPWE aFo/XnYUP28Tlbut+z/aOP4fnPfmPZWOKNH4GLrwth9znJYy7ZNoHwwjBcF/UrTI = DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:references:date:in-reply-to :message-id:mime-version:content-type:content-transfer-encoding; s=default; bh=sGNhwhnnhqvUgsVXnv87ifHhFsM=; b=Z1X5rfolZ6rz6p167 2HvTPFqIRSK7mn8XLvnS87jyjuPLWHhEJKK2BbyE/LLLAuTeIAK1/qyAwd5PzYCu Z7VfwlUIa4TXK7AgpIaTVeVW0dZlYABwEGm5/h7TGY1KxbUePdwTzPykPZlQ+5sM LpMOoDCoti+3pFOqQ4man7VKA8= Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com Delivered-To: mailing list cygwin AT cygwin DOT com Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-6.5 required=5.0 tests=AWL,BAYES_00,GIT_PATCH_2,SPF_PASS autolearn=ham version=3.3.2 spammy=processed, sid, 1012, Hx-spam-relays-external:ESMTPA X-HELO: vsmx012.vodafonemail.xion.oxcs.net From: Achim Gratz To: cygwin AT cygwin DOT com Subject: Re: [Bug] File permissions across domains References: <874lkjt3dw DOT fsf AT Rainer DOT invalid> <20180411070312 DOT GK29703 AT calimero DOT vinschen DOT de> <20180411093443 DOT GM29703 AT calimero DOT vinschen DOT de> Date: Wed, 11 Apr 2018 19:17:24 +0200 In-Reply-To: <20180411093443.GM29703@calimero.vinschen.de> (Corinna Vinschen's message of "Wed, 11 Apr 2018 11:34:43 +0200") Message-ID: <87r2nlwtln.fsf@Rainer.invalid> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 X-VADE-STATUS: LEGIT Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by delorie.com id w3BHHdoY029461 Corinna Vinschen writes: > This is a bit low on detail. What does icacls say about this file? How > does getfacl report the ACL on a machine in the old domain? What does > ls -l report on the file on both machines? Does an strace on getfacl > report an error in ACL checking? There is absolutely no error when stracing getfacl on either machine. From the machine in the new domain (my account is in group cygwinupload and access on this share is via ACL only, I can't change ACL): --8<---------------cut here---------------start------------->8--- /mnt/upload > ll bla ----rwx---+ 1 OLD+gratz OLD+Domain Users 0 Apr 10 15:21 bla (1011)/mnt/upload > getfacl bla # file: bla # owner: OLD+gratz # group: OLD+Domain Users user::--- group::--- group:OLD+FileOperators:rwx group:OLD+cygwinupload:rwx mask:rwx other:--- (1012)/mnt/upload > `cygpath -S`/icacls bla bla OLD\FileOperators:(I)(F) OLD\cygwinupload:(I)(M) Successfully processed 1 files; Failed processing 0 files --8<---------------cut here---------------end--------------->8--- The same thing on a machine in the old domain: --8<---------------cut here---------------start------------->8--- (1007)/mnt/upload > ll bla -rwxrwx---+ 1 gratz Domain Users 0 Apr 10 15:21 bla (1008)/mnt/upload > getfacl bla # file: bla # owner: gratz # group: Domain Users user::rwx group::--- group:FileOperators:rwx group:cygwinupload:rwx mask:rwx other:--- (1009)/mnt/upload > `cygpath -S`/icacls bla bla OLD\FileOperators:(I)(F) OLD\cygwinupload:(I)(M) Successfully processed 1 files; Failed processing 0 files --8<---------------cut here---------------end--------------->8--- Checking how Cygwin reads my own account results in exactly the same SID on both machines as it should, but of course Cygwin translates that to different uid / gid values due to the presence of the domain prefix when I'm logged into the machine in the new domain: OLD+gratz:*:2147559089:2147484161:U-OLD\gratz,S-1-5-21-20…441:/home/gratz:/bin/bash gratz:*:1124017:1049089:U-OLD\gratz,S-1-5-21-20…441:/home/gratz:/bin/bash I have not yet tried to force the account back to a prefix-less interpretation via /etc/passwd (I had to do that in my home network without a DC to solve a similar problem, but I'd like to avoid that here). Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ SD adaptations for KORG EX-800 and Poly-800MkII V0.9: http://Synth.Stromeko.net/Downloads.html#KorgSDada -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple