X-Recipient: archive-cygwin AT delorie DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B64393858D1E
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1710758526;
	bh=hcebdtIpyNb+ZBMm1S2qSI3cuZgC/fj6y+ZwWlwKx7o=;
	h=Date:To:Subject:References:In-Reply-To:List-Id:List-Unsubscribe:
	 List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc:
	 From;
	b=MNwbLJu6Ac00y4XdsfbPyYKGrA638xQ7C6iNBE/0A4X7seWKmTYRDQzH65I1Yzn/4
	 Vypra79Fu2bO24mKJapqJkcYiterqIOIQHsQjn8JhDYCIt6TR6gaBTQu55xriFsNMo
	 kjCXbnJNIn+qBQENoq623Mn1ky9sW0xeTYZK5VS4=
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 095F43858D1E
Date: Mon, 18 Mar 2024 11:41:44 +0100
To: cygwin AT cygwin DOT com
Subject: Re: ACEs and ACLs
Message-ID: <ZfgaaDfqVvzOkUrq@calimero.vinschen.de>
Mail-Followup-To: cygwin AT cygwin DOT com
References: <9bec816c-66ea-49cb-baaa-47137fa2938f AT GMail DOT com>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <9bec816c-66ea-49cb-baaa-47137fa2938f@GMail.com>
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.30
Precedence: list
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: Corinna Vinschen via Cygwin <cygwin AT cygwin DOT com>
Reply-To: cygwin AT cygwin DOT com
Cc: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
Content-Type: text/plain; charset="utf-8"
Errors-To: cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by delorie.com id 42IAg763315775

On Mar 16 18:05, J. Terry Corbet via Cygwin wrote:
> [...]
> And here is the status that icacls reports back on the original, owning
> workstation
> after having use vim to modify the two files from that remote workstation.
> 
> FileExp.txt NULL SID:(DENY)(Rc,S,REA,WEA,X,DC)
>             NW10\tcorbet:(DENY)(S,RD,WD,AD,REA,WEA,X,DC)
>             NW10\tcorbet:(D,Rc,WDAC,WO,RA,WA)
>             NW10\None:(Rc,S,RA)
>             NT AUTHORITY\Authenticated Users:(RX,W)
>             NT AUTHORITY\SYSTEM:(RX,W)
>             BUILTIN\Administrators:(RX,W)
>             BUILTIN\Users:(RX)
>             Everyone:(Rc,S,RA)
> 
> vimtest.txt NULL SID:(DENY)(Rc,S,WEA,X,DC)
>             NW10\tcorbet:(R,W,D,WDAC,WO)
>             NW10\None:(DENY)(S,X)
>             NT AUTHORITY\Authenticated Users:(DENY)(S,X)
>             NT AUTHORITY\SYSTEM:(DENY)(S,X)
>             BUILTIN\Administrators:(DENY)(S,X)
>             BUILTIN\Users:(DENY)(S,X)
>             NW10\None:(RX)
>             NT AUTHORITY\Authenticated Users:(RX,W)
>             NT AUTHORITY\SYSTEM:(RX,W)
>             BUILTIN\Administrators:(RX,W)
>             BUILTIN\Users:(RX)
>             Everyone:(R)
> 
> If my understanding is correct concerning the precedence handling of an
> ACL with multiple ACEs for the same user/ID, this result from grep
> on the original, owning workstation would not surprise you:
> 
> F:\Dev\cygshoot>grep foo fileexp.txt
> grep: fileexp.txt: Permission denied
> 
> but it blows me completely away.  Clearly I no longer have an environment
> in which I can work on any file from any workstation using any Cygwin
> utilities.
> 
> What have I messed up?

The problem is that your identity is based on the SID of every single
machine, and the machines don't know the SIDs of other machines.  The
default ACL created in Cygwin is emulating POSIX permissions.  This
becomes a problem when sharing files between machines not in the
same Windows domain.

The workaround is not to use POSIX permissions on shares.  Create
matching mount points in /etc/fstab or /etc/fstab.d/ and add the
"noacl" mount flag:

  https://cygwin.com/cygwin-ug-net/using.html#mount-table

Alternatively, you can also just add an fstab entry for the cygdrive
prefix which adds the "noacl" flag, see

  https://cygwin.com/cygwin-ug-net/using.html#cygdrive

but keep in mind that this also affects local paths if you access
them via the cygdrive prefix.


HTH,
Corinna

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple