On Feb 19 08:11, Roland Mainz via Cygwin wrote: > Hi! > > ---- > > While implementing chown/chgrp support in the ms-nfs41-client (Windows > NFSv4.1 client filesystem driver) I encountered an issue with group > names. > > I tried a simple $ chgrp CurrentSession myfile #, which returned > "Permission denied".
Works for me: $ chgrp CurrentSession x.c $ ls -l x.c -rw-r--r-- 1 corinna CurrentSession 906 Jan 23 21:40 x.c $ icacls x.c x.c VINSCHEN\corinna:(R,W,D,WDAC,WO) NT AUTHORITY\LogonSessionId_0_2027255:(R) Everyone:(R) Successfully processed 1 files; Failed processing 0 files $ > OK, /usr/bin/id -a shows that the current user is a member of this > group, so I added a new group called "CurrentSession" to the NFSv4.1 > server side ([1]). Just don't do that. This group is a *temporary* group which is created from your login session ID. Your login session is basically a pair of two 32 bit values, generated via NtAllocateLocallyUniqueId(). From there, Windows creates a SID S-1-5-5-<High32bitValue>-<Low32bitValue> These days, when you call LookupAccountSidW() on this SID, you get the info Domain: NT AUTHORITY Namme: LogonSessionId_0_2027255 This SID is used inside your user token to connect your token with the login session for which this token has been created. It can be used for authorization purposes, but it's not meant to be used as a SID in file ownership, even though it's possible (basically any SID can be added to files). So, what's that about "CurrentSession" in Cygwin? The reason is that this is historically what Interix did. Keep in mind that Interix (as well as Cygwin, but that doesn't matter here) exist since Windows NT 3.5 times. The above naming mechanism didn't exist at the time. If you fetched the Logon SID from the token and called LookupAccountSidW() on it, the call failed, i. e., there was no name attached to the SID. So... given that a Logon SID is unique to the logon session, given that the SID has no unambiguous name attached, and given that the Logon SID makes *no sense at all* outside its session, the Interix guys decided to solve this little problem like this: - If the inspected token contains the Logon SID equivalent to the current user session, call it "CurrentSession" with unique gid 4095. - If the inspected token contains a Logon SID which is not attached to the current Logon Session we're running in, call it "OtherSession" with the non-unique gid 4094. This is the model Cygwin follows as well. The Logon SIDs shouldn't really concern you in terms of file access. From the user perspective they are barely informative at all. They *could* make sense in terms of temporary files, but I don't know of any useful example. > But that did not work either, /usr/bin/chgrp # still failed. I can't tell you why it didn't work for you while it works out of the box for me. However, there isn't much sense in there to attach these SIDs to a file. Logout, login again, and you will have a new Logon SID anyway ¯\_(ツ)_/¯ Corinna -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation: https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple