This is the mail archive of the
cygwin
mailing list for the Cygwin project.
Re: CSIH file permission tests on non-NTFS broken (was Re: ssh-host-config script fails)
- From: Corinna Vinschen <corinna-cygwin at cygwin dot com>
- To: cygwin at cygwin dot com
- Date: Thu, 7 Aug 2008 10:14:05 +0200
- Subject: Re: CSIH file permission tests on non-NTFS broken (was Re: ssh-host-config script fails)
- References: <2B02F35EEE21064E9EF7F377F7F37D7402949615@ADMAIL01.ICSDMN.local> <20080723163450.GY5251@calimero.vinschen.de> <20080724092249.GC28166@calimero.vinschen.de> <20080730124957.GN29031@calimero.vinschen.de> <48914567.3010100@cwilson.fastmail.fm> <20080731075001.GA22385@calimero.vinschen.de> <4897A422.4040405@cwilson.fastmail.fm>
- Reply-to: cygwin at cygwin dot com
On Aug 4 20:51, Charles Wilson wrote:
> Corinna Vinschen wrote:
>> A check for non-NTFS should be sufficient for now, IMHO. It's bad
>> enough to run an OS on such an insecure file system, but it's hard to
>> enforce upgrading to NTFS. However, ntsec and smbntsec are dead in the
>> water and I don't think we should encourage usage of noacl more than
>> necessary, especially for sensitive services.
>
> So, I'd basically need to check the fstype for each of the directories of
> interest (they MAY all be on the same volume, but not necessarily).
> /var
> /var/run
> /var/log
> /var/empty
> /etc
> So, how do I do that portably? The 1.7 version of mount returns that
> information, but the 1.5 version does not. What if I import your
Oh, right.
> getvolinfo program
> http://cygwin.com/ml/cygwin/2007-08/msg00040.html
> as one of the csih helper progs, and put it under /usr/lib/csih/
> (alternatively, import getvolinfo into cygutils).
>
> In that case, I wouldn't need to check for NTFS at all -- instead, I'd
> check for "FILE_PERSISTENT_ACLS[ ]*: TRUE", right?
Sounds like a good idea to me. OTOH, whatever you test, you might not
cover all situations. What about letting the user override the test?
Corinna
--
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Project Co-Leader cygwin AT cygwin DOT com
Red Hat
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Problem reports: http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/