1

As far as I know NTFS does not have the concept of a group file owner the way POSIX does. (Please correct me if I'm wrong.) A user can be member of one or (usually) more groups, and a file can have separate permissions for each group, but a file does not have a group owner additionally to its plain vanilla "owner". The "plain owner" however can be, perhaps confusingly, a group.

Now when I do an ls -l in a cygwin 2.8.0 bash on Windows 7 for a file in an NTFS (the machine and account are in an Active Directory environment) I do see a group:

$ ll -n cleartool golden-dev-val.cfgspec
-rwxrwxrwx+ 1 2736485    1049089  277  9. Mai 12:34 cleartool
-rwxrwxrwx+ 1 1493656 3556770305 9159 19. Mai 16:25 golden-dev-val.cfgspec

(The long GID is from a different domain.) At first I thought that cygwin infers the group from the primary group of the owner. That would make the group always change together with the user. However, the two appear to be independent: 

$ chown 2736485  golden-dev-val.cfgspec

$ ll -n cleartool golden-dev-val.cfgspec
-rwxrwxrwx+ 1 2736485    1049089  277  9. Mai 12:34 cleartool
-rwxrwxrwx+ 1 2736485 3556770305 9159 19. Mai 16:25 golden-dev-val.cfgspec

$ chgrp 3556770305 cleartool

$ ll -n cleartool golden-dev-val.cfgspec
-rwxrwxrwx+ 1 2736485 3556770305  277  9. Mai 12:34 cleartool
-rwxrwxrwx+ 1 2736485 3556770305 9159 19. Mai 16:25 golden-dev-val.cfgspec

I have read https://cygwin.com/cygwin-ug-net/ntsec.html which describes how Posix UIDs and GIDs are computed from Windows SIDs; but I fail to see how cygwin stores group ownership for files (which is not a Windows/NTFS feature, so it needs a cygwin add-on) separate from user ownership (which is a Windows/NTFS feature, so it is readily available).

There is a Note about storing comments of the kind <cygwin key="value" key="value" [...] /> for local user accounts via net user ..., including a "group" key; but that's for local accounts, and it's not per file, so it cannot answer my question.

So how does cygwin store and/or obtain group ownership of files? Is it a Windows mechanism? If so, are there Windows tools to manipulate them?

Improve this question
6
  • use cacls <nomefile> to see how NTFS stores all ACL file permissions
    – matzeri
    May 24, 2017 at 18:09
  • Go look at the source code.
    – DavidPostill ♦
    May 24, 2017 at 20:43
  • @matzeri I did that and I can see which permissions the various users or groups have. What I cannot see is a hint which of the various groups would be shown as the "group owner" of the file when I do a stat or ls-l in cygwin.
    – Peter - Reinstate Monica
    May 24, 2017 at 20:50
  • @DavidPostill I first thought you are trolling, but given that you are a mod I suppose you mean it. (On other occasions I found similar code bases opaque to an occasional visitor to the point that I couldn't even identify the place where certain computations were performed, let alone inspect them.) Have you got a hint as to where to look? (I don't mean you to do my work but it may be that you are familiar with the cygwin code base even though cygwin doesn't appear in your tags.) What you surely can confirm is my understanding that NTFS has no concept of a "group owner" in the POSIX sense.
    – Peter - Reinstate Monica
    May 25, 2017 at 9:02
  • @PeterA.Schneider As far as I can tell the ACL code is in newlib. I haven't dug into it any more deeply.
    – DavidPostill ♦
    May 25, 2017 at 9:21

1 Answer 1

Reset to default
1

After superficially browsing through cygwin's source code, I believe chgrp.exe is just indirectly calling RtlSetGroupSecurityDescriptor() - via chown(2) and fhandler_disk_file::set_posix_access().

This functionality is offered at CLI level by subinacl.exe:

subinacl /file testfile /setprimarygroup=groupname

In my test however, the tool requires SeSecurityPrivilege in order to succeed, and SeBackupPrivilege in order not to display a warning.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.