DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 57DHQ38p2098752
Authentication-Results: delorie.com; dmarc=pass (p=none dis=none) header.from=cygwin.com
Authentication-Results: delorie.com; spf=pass smtp.mailfrom=cygwin.com
DKIM-Filter: OpenDKIM Filter v2.11.0 delorie.com 57DHQ38p2098752
Authentication-Results: delorie.com;
	dkim=pass (1024-bit key, unprotected) header.d=cygwin.com header.i=@cygwin.com header.a=rsa-sha256 header.s=default header.b=Rz13eAuA
X-Recipient: archive-cygwin AT delorie DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E59F03858402
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1755105962;
	bh=DbBc6FzHMjWrJxHd4VoPObDiyvGMZgbNF9SUELysmRs=;
	h=Date:To:Subject:In-Reply-To:References:List-Id:List-Unsubscribe:
	 List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:
	 From;
	b=Rz13eAuA1jv8OOjLkFhURywWAWyX04lr5KWCmdhQcLIbeevGN/TyTT3w1aYU19OuG
	 fLeQ/t3DtIM+LkmQt4GUFuC4NYx7BQyF0+wMOMeY6T+cQ5VAcoc+AgED4PP5Eq7K1Z
	 6zwHsr6ZrgKWShwyC0t9BIAN2328flxY1qAsr8zQ=
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org E2DA63858D20
ARC-Filter: OpenARC Filter v1.0.0 sourceware.org E2DA63858D20
ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1755105899; cv=none;
 b=ftVE01Ki0lg6QNnHH+Ejm8qQTCwN7kiwzzIYh40pOBJtwCn3/e/ydIMgn2OvEfb+0Ptg1lSDd7zveUOIk5bJncDb0vyQYi6DIKyEOQOp4mFP/cvJO2tYWd4Hh8miT2fdywsD3DI9y33HgtRBhhr5iQE3eGO+Xo3qrmxwSg/wFU0=
ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key;
 t=1755105899; c=relaxed/simple;
 bh=gcCW5T5dMf/PWf/9XfIfJmbTE8gdBn4mewsDOY0HxwI=;
 h=DKIM-Signature:Date:To:From:Subject:Message-ID:MIME-Version;
 b=UOhhsFhm+ZiwcSegVt0YOhNxXSAW6lrMr3lR4o2TRrRMrErm3zh+gnhCxHkywEhs3dfJs+Vj3skHwoTMbuhHXK/5xqpwSbaHskfhYe07U5SRP6QjS1baUmiNql7XLEIO5rhgx8gYZAmK/kpNr+L1koL4rB5v2rr5kHrlvbXPOFk=
ARC-Authentication-Results: i=1; server2.sourceware.org
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E2DA63858D20
Date: Wed, 13 Aug 2025 17:24:51 +0000
To: "cygwin AT cygwin DOT com" <cygwin AT cygwin DOT com>
Subject: Re: permission problems with Azure
Message-ID: <nub-tjTqXgJtOte47DuztXPZeNzuAmjr12joWOTzXqjA5lKrSG1T_-xviRgjmRvf18OfCSSynQBEi-JYBpTHeK3tgvfdmdu3y7SZANDMG58=@proton.me>
In-Reply-To: <CAKAoaQ=TuTXdB8OUTRXn_pcoWcAXrFonRgaFyBJhBsNvNA+maw@mail.gmail.com>
References: <d47545e2-ce13-4de9-b238-bab25b24b669 AT towo DOT net>
 <CAKAoaQ=TuTXdB8OUTRXn_pcoWcAXrFonRgaFyBJhBsNvNA+maw AT mail DOT gmail DOT com>
Feedback-ID: 153402384:user:proton
X-Pm-Message-ID: 88c6a628d707ff2722a95be948c8916543f939ae
MIME-Version: 1.0
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.30
Precedence: list
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: "albert.m.einstein via Cygwin" <cygwin AT cygwin DOT com>
Reply-To: "albert.m.einstein" <albert DOT m DOT einstein AT proton DOT me>
Content-Type: text/plain; charset="utf-8"
Errors-To: cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by delorie.com id 57DHQ38p2098752

Hey Roland, thanks for your reply, I appreciate your perspective on this. After seeing Brian's message, that prompted me to check the M$ rules. Also thanks to Eliot for trying.

I noticed yesterday I was getting entries in Windows Security > Protection History. I managed to disable the rule: Attack surface reduction: Block use of copied or impersonated system tools. Both with a IT admin over Company Portal, and by running Set-MpPreference provided (thanks)

I then deleted C:/cygwin64, the downloads folder and the setup installer, and redownloaded it. Waited a day and retried. Now I don't see get any new entries in Protection History - great. Now when installing Cygwin, I see: Postinstall script errors:

Package: _/ca-certificates
	ca-certificates.sh exit code 126

Launching Cygwin64 Terminal has these errors on first launch:
```
Copying skeleton files.
These files are for the users to personalise their cygwin experience.

They will never be overwritten nor automatically updated.

-bash: /usr/bin/find: Permission denied
-bash: /usr/bin/hostname: Permission denied
```
and subsequently:
```
-bash: /usr/bin/hostname: Permission denied
```

Therefore I think there is a different permissions error I am facing?

Thank you

On Tuesday, 12 August 2025 at 17:03, Roland Mainz via Cygwin <cygwin AT cygwin DOT com> wrote:

> On Tue, Aug 5, 2025 at 3:27 PM ben-xD via via Cygwin cygwin AT cygwin DOT com wrote:
> 
> > [sending on behalf of ben-xD , redirected from
> > https://github.com/mintty/mintty/issues/563#issuecomment-3155007226]
> > 
> > Dear Cygwin mailing list,
> > 
> > I'd previously been happily using Cygwin on a non Azure AD enrolled
> > machine, but am now setting up a machine that is enrolled.
> > 
> > The problem is some packages fail to install due to permissions
> > issues when I first launch the Cygwin |setup-x86_64.exe|. |126| is a
> > permissions error code:
> > 
> > Screenshot:
> > https://github.com/user-attachments/assets/bf156f43-69d9-4ef7-aa01-0f0c8a80c44a
> > 
> > As soon as I launch Cygwin, I see
> > 
> > -bash: /usr/bin/hostname: Permission denied
> > 
> > |bash -l| also fails:
> > 
> > $ bash -l
> > bash: /usr/bin/hostname: Permission denied
> > 
> > |find| fails:
> > 
> > $ /usr/bin/find
> > bash: /usr/bin/find: Permission denied
> 
> 
> That sounds like a Microsoft Defender problem, which - depending on
> settings - blocks *.exe which have system tools with the same name in
> $PATH.
> 
> Example:
> ---- snip ----
> $ which -a hostname
> /usr/bin/hostname
> /cygdrive/c/Windows/system32/hostname
> ---- snip ----
> Defender thinks that /usr/bin/hostname tries to impersonate
> /cygdrive/c/Windows/system32/hostname, and therefore blocks it's
> execution.
> 
> Could you please try whether this fixes the problem for you (see
> https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference
> section "Block use of copied or impersonated system tools"):
> $ powershell -Command 'Set-MpPreference
> -AttackSurfaceReductionRules_Ids C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB
> -AttackSurfaceReductionRules_Actions Disabled #
> 
> ... and please respond back to the list whether it worked, because
> this more or less has become a candidate for the Cygwin FAQ... ;-(
> 
> ----
> 
> Bye,
> Roland
> --
> __ . . __
> (o.\ \/ /.o) roland DOT mainz AT nrubsig DOT org
> \\/\// MPEG specialist, C&&JAVA&&Sun&&Unix programmer
> /O /==\ O\ TEL +49 641 3992797
> (;O/ \/ \O;)
> 
> --
> Problem reports: https://cygwin.com/problems.html
> FAQ: https://cygwin.com/faq/
> Documentation: https://cygwin.com/docs.html
> Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple