DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 4ABDJ79a3812042
Authentication-Results: delorie.com; dmarc=pass (p=none dis=none) header.from=cygwin.com
Authentication-Results: delorie.com; spf=pass smtp.mailfrom=cygwin.com
DKIM-Filter: OpenDKIM Filter v2.11.0 delorie.com 4ABDJ79a3812042
Authentication-Results: delorie.com;
	dkim=pass (1024-bit key, unprotected) header.d=cygwin.com header.i=@cygwin.com header.a=rsa-sha256 header.s=default header.b=pRjsdC2k
X-Recipient: archive-cygwin AT delorie DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B1F273858CDA
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1731331146;
	bh=xhllyhb7aHuj7EOhT2KkvQdrVFMgZV6Pu7PTTNufznM=;
	h=Date:To:Subject:References:In-Reply-To:List-Id:List-Unsubscribe:
	 List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc:
	 From;
	b=pRjsdC2kTFTvOd3tpVMHCpHiHhUuvhSuJRNZmS5n7esleOGXksQsrxgrw7ZDMAoKN
	 2o+aarHw5ZZl/4ZlO4pQcrwXtTN5Yc9aZ2KzSk1NVRWRqohODD3QmS6cIOS7WquQas
	 1/PTPhAXNhkOFCQFoBdZAY4foamC2geaf1XgSwlg=
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 76CA43858D29
Date: Mon, 11 Nov 2024 14:18:07 +0100
To: cygwin AT cygwin DOT com
Subject: Re: SMBFS mount's file cannot be made executable
Message-ID: <ZzIEDxjvUcDA05pa@calimero.vinschen.de>
Mail-Followup-To: cygwin AT cygwin DOT com
References: <BL0PR0901MB430827F1A0668E468B498FBBA5D70 AT BL0PR0901MB4308 DOT namprd09 DOT prod DOT outlook DOT com>
 <20241108205109 DOT 55f99e2d172b9fc87e92ae67 AT nifty DOT ne DOT jp>
 <Zy4ODHHpmZPggGSz AT calimero DOT vinschen DOT de>
 <20241111193152 DOT c3a81044a03ecf2093185166 AT nifty DOT ne DOT jp>
 <ZzHizX_6FXABDPvZ AT calimero DOT vinschen DOT de>
 <20241111201928 DOT 811a2f8f09142b7aa8fe9bdc AT nifty DOT ne DOT jp>
 <ZzHxrUTHKYSTXrwE AT calimero DOT vinschen DOT de>
 <20241111220030 DOT f872264d5c9186e997213513 AT nifty DOT ne DOT jp>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <20241111220030.f872264d5c9186e997213513@nifty.ne.jp>
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.30
Precedence: list
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: Corinna Vinschen via Cygwin <cygwin AT cygwin DOT com>
Reply-To: cygwin AT cygwin DOT com
Cc: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

On Nov 11 22:00, Takashi Yano via Cygwin wrote:
> On Mon, 11 Nov 2024 12:59:41 +0100
> Corinna Vinschen wrote:
> > On Nov 11 20:19, Takashi Yano via Cygwin wrote:
> > > On Mon, 11 Nov 2024 11:56:13 +0100
> > > Corinna Vinschen wrote:
> > > 
> > > > On Nov 11 19:31, Takashi Yano via Cygwin wrote:
> > > > > On Fri, 8 Nov 2024 14:11:40 +0100
> > > > > Corinna Vinschen wrote:
> > > > > > If the server is a Samba share, check if `force unknown acl user = yes'
> > > > > > and for the share itself, check that
> > > > > > 
> > > > > >   read only = No
> > > > > >   vfs objects = acl_xattr
> > > > >     ^^^^^^^^^^^^^^^^^^^^^^^
> > > > > Thanks! This makes things better.
> > > > > At least x permissions are set to executable compiled by gcc.
> > > > > 
> > > > > However, something is still wrong in my environment....
> > > > > Others permission seems to be reffered in some cases.
> > > > 
> > > > I don't understand.  Please run icacls for a just created file on your
> > > > Samba share (without the below patch) as well as Windows' `whoami /all'.
> > > 
> > > $ touch samba_test_file.txt
> > > $ icacls samba_test_file.txt
> > > samba_test_file.txt S-1-5-21-479325430-3041864944-504445739-1000:(R,W,D,WDAC,WO)
> > >                     S-1-5-21-479325430-3041864944-504445739-513:(R)
> > >                     Everyone:(R)
> > > 
> > > This seems reasonable to me.
> > > 
> > > For Windows 11 share, the result is
> > > samba_test_file.txt NULL SID:(DENY)(Rc,S,WEA,X,DC)
> > >                     S-1-5-21-2089672436-4097686843-2104605006-1001:(R,W,D,WDAC,WO)
> > 
> >   On Samba S-1-5-21-479325430-3041864944-504445739-1000
> >   On Windows S-1-5-21-2089672436-4097686843-2104605006-1001
> > 
> > Isn't the user mapping off?
> > 
> > It's also not clear where your Windows ACL comes from.  When I check the
> > permissions on typical Windows folders, Authenticated Users doesn't even
> > show up.
> 
> On my machine,
> 
> C:\Users\yano>mkdir \test_folder
> 
> C:\Users\yano>icacls \test_folder
> \test_folder BUILTIN\Administrators:(I)(OI)(CI)(F)
>              NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>              BUILTIN\Users:(I)(OI)(CI)(RX)
>              NT AUTHORITY\Authenticated Users:(I)(M)
>              NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)

Those are inherited from the parent folder, i. e., C:\.

$ icacls C:\\
c:\ S-1-15-3-65536-1888954469-739942743-1668119174-2468466756-4239452838-1296943325-355587736-700089176:(S,RD,X,RA)
    BUILTIN\Administrators:(OI)(CI)(F)
    NT AUTHORITY\SYSTEM:(OI)(CI)(F)
    BUILTIN\Users:(OI)(CI)(RX)
    NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M)
    NT AUTHORITY\Authenticated Users:(AD)
    Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW)

Funny enough, the C:\ default ACL on servers doesn't contain entries for
Authenticated Users.  The group Users is tasking its place.


Corinna

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple