DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 57CG2f4m1637711
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org F3ABD3858D38
MIME-Version: 1.0
References: <d47545e2-ce13-4de9-b238-bab25b24b669 AT towo DOT net>
In-Reply-To: <d47545e2-ce13-4de9-b238-bab25b24b669@towo.net>
Date: Tue, 12 Aug 2025 18:01:34 +0200
Message-ID: <CAKAoaQ=TuTXdB8OUTRXn_pcoWcAXrFonRgaFyBJhBsNvNA+maw@mail.gmail.com>
Subject: Re: permission problems with Azure
To: cygwin AT cygwin DOT com
From: Roland Mainz via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Roland Mainz <roland DOT mainz AT nrubsig DOT org>
Content-Type: text/plain; charset="utf-8"
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit

On Tue, Aug 5, 2025 at 3:27 PM ben-xD via via Cygwin <cygwin AT cygwin DOT com> wrote:
>
>     [sending on behalf of *ben-xD* , redirected from
>     https://github.com/mintty/mintty/issues/563#issuecomment-3155007226]
>
>     Dear Cygwin mailing list,
>
>     I'd previously been happily using Cygwin on a non Azure AD enrolled
>     machine, but am now setting up a machine that is enrolled.
>
>     The problem is some packages fail to install due to permissions
>     issues when I first launch the Cygwin |setup-x86_64.exe|. |126| is a
>     permissions error code:
>
>     Screenshot:
>     https://github.com/user-attachments/assets/bf156f43-69d9-4ef7-aa01-0f0c8a80c44a
>
>     As soon as I launch Cygwin, I see
>
>     -bash: /usr/bin/hostname: Permission denied
>
>     |bash -l| also fails:
>
>     $ bash -l
>     bash: /usr/bin/hostname: Permission denied
>
>     |find| fails:
>
>     $ /usr/bin/find
>     bash: /usr/bin/find: Permission denied

That sounds like a Microsoft Defender problem, which - depending on
settings - blocks *.exe which have system tools with the same name in
$PATH.

Example:
---- snip ----
$ which -a hostname
/usr/bin/hostname
/cygdrive/c/Windows/system32/hostname
---- snip ----
Defender thinks that /usr/bin/hostname tries to impersonate
/cygdrive/c/Windows/system32/hostname, and therefore blocks it's
execution.

Could you please try whether this fixes the problem for you (see
https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference
section "Block use of copied or impersonated system tools"):
$ powershell -Command 'Set-MpPreference
-AttackSurfaceReductionRules_Ids C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB
-AttackSurfaceReductionRules_Actions Disabled #

... and please respond back to the list whether it worked, because
this more or less has become a candidate for the Cygwin FAQ... ;-(

----

Bye,
Roland
-- 
  __ .  . __
 (o.\ \/ /.o) roland DOT mainz AT nrubsig DOT org
  \__\/\/__/  MPEG specialist, C&&JAVA&&Sun&&Unix programmer
  /O /==\ O\  TEL +49 641 3992797
 (;O/ \/ \O;)

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple