This is the mail archive of the
cygwin
mailing list for the Cygwin project.
Re: Problem with "None" Group on Non-Domain Members
- From: "Chris J. Breisch" <chris dot ml at breisch dot org>
- To: cygwin at cygwin dot com
- Date: Mon, 05 May 2014 14:56:37 -0400
- Subject: Re: Problem with "None" Group on Non-Domain Members
- Authentication-results: sourceware.org; auth=none
- References: <536796E4 dot 2090009 at breisch dot org> <20140505135928 dot GK30918 at calimero dot vinschen dot de> <53679D5C dot 5030209 at breisch dot org> <20140505144745 dot GA6993 at calimero dot vinschen dot de> <5367ACED dot 40409 at breisch dot org> <20140505154230 dot GB7694 at calimero dot vinschen dot de> <5367B990 dot 8050907 at breisch dot org> <20140505165723 dot GM30918 at calimero dot vinschen dot de>
Corinna Vinschen wrote:
On May 5 12:17, Chris J. Breisch wrote:
Corinna Vinschen wrote:
An strace of `chmod 400 bar' might sched some light on this issue, but I
have a gut feeling the underlying WIndows call will not even return an
error code...
Attached. Your gut seems to be working today...
There *is* something weird here. Look at this:
151 36702 [main] chmod 5536 alloc_sd: uid 1001, gid 513, attribute 0x2190
65 36767 [main] chmod 5536 cygsid::debug_print: alloc_sd: owner SID = S-1-5-21-3514886939-1786686319-3519756147-1001 (+)
70 36837 [main] chmod 5536 cygsid::debug_print: alloc_sd: group SID = S-1-5-21-3514886939-1786686319-3519756147-1001 (+)
alloc_sd (the underlying function creating a security descriptor) gets
a uid 1001 and gid 513 as input, as usual. But the owner *and* group
SIDs of the file's existing security descriptor is
S-1-5-21-3514886939-1786686319-3519756147-1001, the SID of your user
account.
Why is your user account the primary group of the file, even though
your user token definitely has "None" (513) as its primary group?
How did it get there?
I don't have a clue. You're the expert. :)
The ACLs are a little different between the Microsoft Account and the
regular local account. But, if anything, it's the regular one that looks
odd to me.
Microsoft Account:
$ icacls bar
bar WIN8-VM\Chris:(R,D,WDAC,WO,WA)
Everyone:(Rc,S,RA)
NT AUTHORITY\Authenticated Users:(M)
Local account:
$ icacls foo
foo WIN8-VM\cjb:(R,D,WDAC,WO,WA)
WIN8-VM\None:(Rc,S,RA)
Everyone:(Rc,S,RA)
Why does the local account have None permissions, and not Authenticated
Users?
Is that something enforced by the "Microsoft accounts", perhaps?
I just had a look into the Local Security Policy settings, and I can't
see any related setting.
I have no clue. If you want to throw some more debugging code into a
snapshot, I'll happily test it. I'll do whatever you want, even shut up
and go away. :)
I should point out that all of this is with Cygwin64. From what we've
discovered so far, it seems likely that I'll get the same behavior under
Cygwin32. But I'll verify that tonight when I get home.
--
Chris J. Breisch
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple