Shares with strange ACL settings

Achim Gratz Stromeko@nexgo.de
Thu Aug 13 17:48:00 GMT 2015


Corinna Vinschen writes:
> This puzzles me a bit.  As example you gave something like
>
>   ----rwx---+ gratz Domain Users [...] foo
>
> Given the code in recent Cygwin versions, this shouldn't happen if the
> user gratz is member of the Domain Users group.  The current code
> doesn't test all groups in the ACL, only the primary group, but that's
> sufficient in most cases.

I've detailed the setup in an earlier post (with getfacl and icacls
output) that I can't dig out shortly, but the setup is, in a nutshell:

The share access is purely governed by two access groups, one that gives
you the right to read and another one that lets you create and change
things.  You'll be in one or both of these groups in AD.  All ACL are
inherited from the root of the share down and the right to change the
DACL (and thus remove that inheritance) is explicitly forbidden for
anybody.

The actual setup is a bit more complicated, with additional groups that
ensure that share administrators can do what they need to do and that
the backup can actually be done, etc.pp.

> So this could only happen if you modify the permissions of windows files
> using Cygwin tools and Cygwin helpfully gernerates a DENY ACE for the
> owner.

No, the owner just never gets the full access it would need to do this.
For a while they didn't even let you look at the DACL, but at least that
part of the silliness has been fixed.

> I'm just not exactly sure about the way to go to get these permissions
> in a non-artificial scenario.  But I can reproduce it like this:
>
> - The file xxx has a primary group different from the group which has
>   permissions, e.g.:
>
>     owner:  foo
>     pgroup: foo_group
>
>     acl: 1 entry
>       bar_group: full control
>
> - ls -l xxx
>   ----rwx---+ 1 foo foo_group 68565 Aug 10 10:37 xxx
>
> - $ chmod g-w xxx

The chmod, if you try to run it, never succeeds.  That's the crux of
this setup, anything will always have just rwx for the group via ACL and
you can't change that.

> So, what's going on here and how do we really fix it?  It *might* be
> prudent to drop any efforts to create DENY ACEs to reflect the POSIX
> perms.  That results in the documented permission gap between POSIX and
> Windows permissions, though.  There's just no way to express all possible
> POSIX permissions using Windows ALLOW ACEs only.

There aren't any deny ACL, you just don't get the right to play with the
permissions to start with.  FOr Windows it doesn't matter that the owner
hasn't got any access rights as long as she's in a group that has.
POSIX doesn't even look at the group/ACL if it the owner bits are
cleared.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Waldorf MIDI Implementation & additional documentation:
http://Synth.Stromeko.net/Downloads.html#WaldorfDocs

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple



More information about the Cygwin mailing list