Re: group permissions

[Achim Gratz <Stromeko at NexGo dot DE>]

Corinna Vinschen <corinna-cygwin <at> cygwin.com> writes:
> Here's the problem:  Windows doesn't support an ACL_MASK entry, nor
> anything even remotely resembling it.

Right.  And pretending that it does is doing more harm than good, IMHO.

> o The other way to emulate writing an ACL_MASK entry would be to drop
>   permissions from all groups and secondary users so they match the
>   desired mask value.  This is secure, but in contrast to the other
>   solution it would change the secondary permissions permanently.
>   Changing the mask back would not change the permissions of the
>   secondary ACL entries back.

Please note that that the typical user in a corporate environment has no
rights to do this on network shares and even if (s)he did, it would quite
often break things for other users and is certain to draw the ire of the
share administrators just as if you'd do the same thing via WIndows' own
tools.  So please do not do this by default, there are just too many scripts
that blindly use some chmod somewhere.

> o Cygwin could emulate the mask by adding an Access-denied ACE for the
>   authenticated user SID (S-1-5-11) right after the primary group entry.
>   The permission in this ACE are the x'or value of the permissions
>   given in the mask.  Such an ACL would basically look like this:

Same issue as above, except it would be more easily reversible.

If anybody feels really strongly about these issues, they can always mount
"noacl".  We'll just have to live with how Windows implements ACL otherwise.


Regards,
Achim,


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple