cygwin can bypass windows xp acls?

Question

How is cygwin able to bypass Windows XP ACLS? In the following example, cmd.exe cannot create a file in a directory but bash can. What gives?

C:\WINDOWS\Temp>mkdir noaccess

C:\WINDOWS\Temp>cacls noaccess /E /R Everyone
processed dir: C:\WINDOWS\Temp\noaccess

C:\WINDOWS\Temp>cacls noaccess
C:\WINDOWS\Temp\noaccess

C:\WINDOWS\Temp>echo abc > noaccess\abc
Access is denied.

C:\WINDOWS\Temp>c:\cygwin\bin\bash -c "echo abc > noaccess/abc"

C:\WINDOWS\Temp>c:\cygwin\bin\bash -c "/bin/cat noaccess/abc"
abc

Answer 1

I guess it's to do with the noacl option

noacl - Cygwin ignores filesystem ACLs and only fakes a subset of permission bits based on the DOS readonly attribute. This behaviour is the default on FAT and FAT32. The flag is ignored on NFS filesystems.

This doesn't really explain how Windows isn't able to enforce ACLs. I guess Cygwin has elevated privileges of some sort. Probably this will become clearer if you read about Cygwin and "NT" Security

Answer 2

Cygwin apps do not have any special privileges, but they do "try harder". If a Win32 call fails, Cygwin will try using an NT kernel API function to perform the equivalent operation (and sometimes it just uses the NT kernel API first). Oddly, the NT kernel APIs can succeed where Win32 APIs fail.