This is the mail archive of the cygwin mailing list for the Cygwin project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: Making Cygwin More Tolerant of Orphaned SIDs?


On Tue, Apr 14, 2015 at 10:53 AM, Corinna Vinschen
<corinna-cygwin@cygwin.com> wrote:
> On Apr 14 07:24, Bryan Berns wrote:
>> On Tue, Apr 14, 2015 at 4:00 AM, Corinna Vinschen
>> >
>> > The problem is that Cygwin, or any other tool trying to resolve SIDs
>> > doesn't know a SID won't resolve before it tried.  And then it's an
>> > OS function which takes its time.  It's like checking for network
>> > machines providing shares.  Sometimes this test takes ages, but in
>> > this case, fortunately, you see that it takes ages in Explorer as
>> > well.
>> >
>> > As for ACLs, you can alleviate the problem somewhat by running cygserver
>> > on the machine, which allows to cache SIDs for all processes.  So only
>> > the first process trying the SID will take time, followup processes will
>> > get the cached results from cygserver.
>> >
>> > Other than that, except for ignoring ACLs entirely (noacl) I have
>> > no idea how to solve this problem differently.
>>
>> Yes, I understand there's nothing Cygwin can do beforehand -- that
>> means sense.  I guess what I'm saying is that Cygwin doesn't appear to
>> be caching SIDs in certain scenarios.
>>
>> For example, I create a whole bunch of files (like 5000),  I use
>> icacls to append a new ACE.  Then I do a 'time ls -l
>> /cygdrive/c/somedir/*'.  Takes four seconds.  In the same Cygwin
>> session, I remove the local group (net localgroup testgroup /delete).
>>  I do the same 'time ls -l /cygdrive/c/somedir/*'.  Takes 20 seconds.
>> Subsequent runs in the also take 20 seconds.  Since I'm able to
>> continue to see the slowdown in the same session, cygserver wouldn't
>> help right?
>>
>> Is the above expected?
>
> Yes.  Without cygserver, caching only works from parent to child process.
> One run of ls can't cache data for a parallel run of ls in trhe same
> session.  As, btw., explained in the documentation:
>
>   https://cygwin.com/cygwin-ug-net/ntsec.html

Alright, I'll give it a shot when I get back to my lab.  I suspect it
shouldn't take an additional 16 seconds to attempt to lookup account
information (and fail) on my two node test network so I'm curious how
much this will cut the time by.
If I setup cygserver with all the --no options set (reference:
https://cygwin.com/cygwin-ug-net/using-cygserver.html) since I don't
want any accidental cross-user information sharing, will that
effectively only provide the SID caching functionality or is there
other functionality to be wary of?

Thanks for everything!

Bryan

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]