Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How is cygwin able to bypass Windows XP ACLS? In the following example, cmd.exe cannot create a file in a directory but bash can. What gives?

C:\WINDOWS\Temp>mkdir noaccess

C:\WINDOWS\Temp>cacls noaccess /E /R Everyone
processed dir: C:\WINDOWS\Temp\noaccess

C:\WINDOWS\Temp>cacls noaccess

C:\WINDOWS\Temp>echo abc > noaccess\abc
Access is denied.

C:\WINDOWS\Temp>c:\cygwin\bin\bash -c "echo abc > noaccess/abc"

C:\WINDOWS\Temp>c:\cygwin\bin\bash -c "/bin/cat noaccess/abc"
share|improve this question
up vote 0 down vote accepted

Cygwin apps do not have any special privileges, but they do "try harder". If a Win32 call fails, Cygwin will try using an NT kernel API function to perform the equivalent operation (and sometimes it just uses the NT kernel API first). Oddly, the NT kernel APIs can succeed where Win32 APIs fail.

share|improve this answer

I guess it's to do with the noacl option

noacl - Cygwin ignores filesystem ACLs and only fakes a subset of permission bits based on the DOS readonly attribute. This behaviour is the default on FAT and FAT32. The flag is ignored on NFS filesystems.

This doesn't really explain how Windows isn't able to enforce ACLs. I guess Cygwin has elevated privileges of some sort. Probably this will become clearer if you read about Cygwin and "NT" Security

share|improve this answer
Thanks. The filesystem is NTFS so the FAT part does not apply. It certainly seems cygwin is running with some privileges but I would have thought it would not do so by default. The documentation you referenced probably explains this but it seems very involved and quick read does not show any sections that specifically talk about cygwin using privileged access. – Miserable Variable Feb 10 '12 at 21:11
Cygwin's docs on NTFS and ACLs under Cygwin: – Andrew Lambert Feb 10 '12 at 22:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .