On Mon, 11 Nov 2024 14:35:55 +0100 Corinna Vinschen wrote: > On Nov 11 21:19, Takashi Yano via Cygwin wrote: > > On Mon, 11 Nov 2024 13:03:18 +0100 > > Corinna Vinschen wrote: > > > On Nov 11 20:40, Takashi Yano via Cygwin wrote: > > > > On Mon, 11 Nov 2024 20:32:02 +0900 > > > > Takashi Yano via Cygwin <cygwin@cygwin.com> wrote: > > > > > Even with this patch, the file: > > > > > > > > > > yano $ touch samba_test_file.txt > > > > > yano $ ls -l samba_test_files.txt > > > > > -rw-r--r-- 1 yano yano 0 Nov 11 20:25 samba_test_file.txt > > > > > > > > Oops! This was wrong. > > > > -rw-r--r-- 1 Unknown+User Unix_Group+1000 0 Nov 11 20:25 > > > > samba_test_file.txt > > > > > > That's Samba for you. I applied your patch and created a file > > > on my share, and the Authenticated Users group was not in the > > > resulting ACL. Only user, group, and Everyone. > > > > > > Either way, I don't think this is the right thing to do. Even if > > > the group isn't added to the ACL on my machine, it still loks like > > > a security problem in waiting. > > > > Isn't this DACL here used only for access_check() (NtAccessCheck())? > > In my environment, the Authenticated Users does not appear in the ACL > > too. > > Oh, yeah, right, *blush*. > > But it's still not the right thing to do. You convert the Samba ACL > to a Windows ACL which gives Authenticated Users full permissions. > So the check_access() function will return false positives, because > every authenticated user is in the Authenticated Users group and has > supposedly FILE_ALL_ACCESS. Even if the actual function (read, write, > execute) will fail, the access() function will claim that every > authenticated user has RWX perms.
Ah, right. I have just confirmed that behaviour... > AFAICS, the underlying problem is somehow the user mapping. Did you > try with username map = /foo/bar? Yes. However, my user name is 'yano' both in server (Linux) and client (Windows 10) side. So, I think there is no effect of 'username map'. -- Takashi Yano <takashi.y...@nifty.ne.jp> -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation: https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
