This is the mail archive of the
mailing list for the Cygwin project.
Re: Shares with strange ACL settings
- From: Achim Gratz <Stromeko at nexgo dot de>
- To: cygwin at cygwin dot com
- Date: Thu, 13 Aug 2015 19:47:08 +0200
- Subject: Re: Shares with strange ACL settings
- Authentication-results: sourceware.org; auth=none
- References: <loom dot 20150811T101658-176 at post dot gmane dot org> <20150812152601 dot GL13029 at calimero dot vinschen dot de> <loom dot 20150812T172703-7 at post dot gmane dot org> <20150812155817 dot GN13029 at calimero dot vinschen dot de> <878u9g9y6b dot fsf at Rainer dot invalid> <20150812183220 dot GO13029 at calimero dot vinschen dot de> <87vbck8h92 dot fsf at Rainer dot invalid> <20150813163302 dot GB28349 at calimero dot vinschen dot de>
Corinna Vinschen writes:
> This puzzles me a bit. As example you gave something like
> ----rwx---+ gratz Domain Users [...] foo
> Given the code in recent Cygwin versions, this shouldn't happen if the
> user gratz is member of the Domain Users group. The current code
> doesn't test all groups in the ACL, only the primary group, but that's
> sufficient in most cases.
I've detailed the setup in an earlier post (with getfacl and icacls
output) that I can't dig out shortly, but the setup is, in a nutshell:
The share access is purely governed by two access groups, one that gives
you the right to read and another one that lets you create and change
things. You'll be in one or both of these groups in AD. All ACL are
inherited from the root of the share down and the right to change the
DACL (and thus remove that inheritance) is explicitly forbidden for
The actual setup is a bit more complicated, with additional groups that
ensure that share administrators can do what they need to do and that
the backup can actually be done, etc.pp.
> So this could only happen if you modify the permissions of windows files
> using Cygwin tools and Cygwin helpfully gernerates a DENY ACE for the
No, the owner just never gets the full access it would need to do this.
For a while they didn't even let you look at the DACL, but at least that
part of the silliness has been fixed.
> I'm just not exactly sure about the way to go to get these permissions
> in a non-artificial scenario. But I can reproduce it like this:
> - The file xxx has a primary group different from the group which has
> permissions, e.g.:
> owner: foo
> pgroup: foo_group
> acl: 1 entry
> bar_group: full control
> - ls -l xxx
> ----rwx---+ 1 foo foo_group 68565 Aug 10 10:37 xxx
> - $ chmod g-w xxx
The chmod, if you try to run it, never succeeds. That's the crux of
this setup, anything will always have just rwx for the group via ACL and
you can't change that.
> So, what's going on here and how do we really fix it? It *might* be
> prudent to drop any efforts to create DENY ACEs to reflect the POSIX
> perms. That results in the documented permission gap between POSIX and
> Windows permissions, though. There's just no way to express all possible
> POSIX permissions using Windows ALLOW ACEs only.
There aren't any deny ACL, you just don't get the right to play with the
permissions to start with. FOr Windows it doesn't matter that the owner
hasn't got any access rights as long as she's in a group that has.
POSIX doesn't even look at the group/ACL if it the owner bits are
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+
Waldorf MIDI Implementation & additional documentation:
Problem reports: http://cygwin.com/problems.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple