Re: cacls combination problem in 1.7.35, merging privs of existing file & privs of process

[Corinna Vinschen <corinna-cygwin at cygwin dot com>]

Hi John,

On Jun 22 14:15, John Ruckstuhl wrote:
> On Sat, Jun 20, 2015 at 11:41 AM, John Ruckstuhl
> <John.Ruckstuhl@intusurg.com> wrote:
> >
> > I'm noticing this summer, that whenever I try to edit an existing file with vi for the first time, the file's permissions change.  Could this be a problem with merging permissions of existing file and permissions of the vi process?
> 
> To clarify, for me, when the vi process is writing out a fresh file,
> the new file gets an acl ...

Yes, it's a combination of the POSIX permissions and the inherited
ACEs from the parent directory.

> Then when vi overwrites that file
> (presumably creating a new file with an acl per the merging of the
> existing acl and new-file acl, the result is different acl.  The file
> when first written -- execution via the shebang works.  When updated,
> something -- the file or the shebang -- doesn't execute anymore.
> 
> I believe this is easily reproducible (1.7.35).  My umask is 0022.
> 
> 1.  In vi, create 2 lines of content including a shebang, like this:
>         !# /usr/bin/sh
>         date
> 2.  write it out to a file, like try.sh
> 3.  execute it
>         ./try.sh
>     it works, right?

Not for me.

> 4.  write the file back out a 2nd time (no changes)
> 5.  execute it again
>         ./try.sh
>     but this time, it doesn't work
>         -bash: ./try.sh: Permission denied
> 6.  now delete the shebang line, and write the file out (3rd time)
> 7.  execute it again
>         ./try.sh
>     it works again.  Huh?
> 
Nope, not here.

> So yes I am still puzzled about the acl diff between the 1st & 2nd
> file-write, and also it looks like it's a shebang interaction.
> 
> FWIW, I think my user sid & group sid are different. See Footnote [3] below.
> 
> Best regards,
> John
> 
> Footnotes
> [3]
> I claim user sid & group sid are different because id says:
>     uid=1158474(johnru) gid=1049089(Domain Users)
> groups=1049089(Domain
> Users),544(Administrators),545(Users),4(INTERACTIVE),66049(CONSOLE
> LOGON),11(Authenticated Users),15(This
> Organization),4095(CurrentSession),66048(LOCAL),1058289(Corporate
> Employees), ...
> 
> and the RIDs are different (109898 != 513) (btw, is this the accepted
> technique to get SID?):
> 
>     C:\Users\johnru>wmic useraccount where name='JohnRu' get sid
>     SID
>     S-1-5-21-25853599-488532567-929701000-109898

You can do this with Cygwin tools:

  $ getent -w passwd JohnRu
  JohnRu:1158474:INTSURG\JohnRu:S-1-5-21-25853599-488532567-929701000-109898

  The format is:

  Cygwin username:UID:Windows domain&username:SID

And of course your user account is different from your primary group.
They can only ever be identical on non-domain mamber machines when using
the "Microsoft Accounts", where you login with your email address.

>     C:\Users\johnru>wmic group where name='Domain Users' get sid
>     SID
>     S-1-5-21-25853599-488532567-929701000-513
> 
> >
> > Original cacls of file try2.txt:
> >     try2.txt INTSURG\johnru:(R,W,D,WDAC,WO)
> >              INTSURG\Domain Users:(R)
> >              Everyone:(R)
> >              NT AUTHORITY\SYSTEM:(F)
> >              BUILTIN\Administrators:(F)
> > Cacls after vi open & write back out (":wq")
> >     try2.txt INTSURG\johnru:(DENY)(S,X)
> >              INTSURG\johnru:(R,W,D,WDAC,WO)
> >              INTSURG\Domain Users:(RX,W)
> >              Everyone:(R)
> >              NT AUTHORITY\SYSTEM:(RX,W)
> >              BUILTIN\Administrators:(RX,W)

After I set up a directory with your permissions, I can reproduce this.
I have an idea what the problem is, but I have to debug this further.
Stay tuned.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

Attachment: pgpg0zhVuLMlT.pgp
Description: PGP signature