As far as I know NTFS does not have the concept of a group file owner the way POSIX does. (Please correct me if I'm wrong.) A user can be member of one or (usually) more groups, and a file can have separate permissions for each group, but a file does not have a group owner additionally to its plain vanilla "owner". The "plain owner" however can be, perhaps confusingly, a group.
Now when I do an ls -l
in a cygwin 2.8.0 bash on Windows 7 for a file in an NTFS (the machine and account are in an Active Directory environment) I do see a group:
$ ll -n cleartool golden-dev-val.cfgspec
-rwxrwxrwx+ 1 2736485 1049089 277 9. Mai 12:34 cleartool
-rwxrwxrwx+ 1 1493656 3556770305 9159 19. Mai 16:25 golden-dev-val.cfgspec
(The long GID is from a different domain.) At first I thought that cygwin infers the group from the primary group of the owner. That would make the group always change together with the user. However, the two appear to be independent:
$ chown 2736485 golden-dev-val.cfgspec
$ ll -n cleartool golden-dev-val.cfgspec
-rwxrwxrwx+ 1 2736485 1049089 277 9. Mai 12:34 cleartool
-rwxrwxrwx+ 1 2736485 3556770305 9159 19. Mai 16:25 golden-dev-val.cfgspec
$ chgrp 3556770305 cleartool
$ ll -n cleartool golden-dev-val.cfgspec
-rwxrwxrwx+ 1 2736485 3556770305 277 9. Mai 12:34 cleartool
-rwxrwxrwx+ 1 2736485 3556770305 9159 19. Mai 16:25 golden-dev-val.cfgspec
I have read https://cygwin.com/cygwin-ug-net/ntsec.html which describes how Posix UIDs and GIDs are computed from Windows SIDs; but I fail to see how cygwin stores group ownership for files (which is not a Windows/NTFS feature, so it needs a cygwin add-on) separate from user ownership (which is a Windows/NTFS feature, so it is readily available).
There is a Note about storing comments of the kind <cygwin key="value" key="value" [...] />
for local user accounts via net user ...
, including a "group" key; but that's for local accounts, and it's not per file, so it cannot answer my question.
So how does cygwin store and/or obtain group ownership of files? Is it a Windows mechanism? If so, are there Windows tools to manipulate them?
cacls <nomefile>
to see how NTFS stores all ACL file permissions