rmischke-dlr commented on issue #282:
URL: https://github.com/apache/mina-sshd/issues/282#issuecomment-1345269439
I put that code into the test program, and this is the result after running
it on one of the Win10 machines where it previously failed:
```
ACL:
Principal: VORDEFINIERT\Administratoren (Alias)
Type: ALLOW
Permissions: []
Owner~Principal: false
ACL:
Principal: NT-AUTORITÄT\SYSTEM (Well-known group)
Type: ALLOW
Permissions: []
Owner~Principal: false
ACL:
Principal: VORDEFINIERT\Benutzer (Alias)
Type: ALLOW
Permissions: []
Owner~Principal: false
ACL:
Principal: NT-AUTORITÄT\Authentifizierte Benutzer (Well-known group)
Type: ALLOW
Permissions: []
Owner~Principal: false
ACL:
Principal: DLR\user_a (User)
Type: ALLOW
Permissions: [EXECUTE, WRITE_ACL, READ_ATTRIBUTES, SYNCHRONIZE,
WRITE_DATA, READ_ACL, WRITE_ATTRIBUTES, READ_NAMED_ATTRS, DELETE,
WRITE_NAMED_ATTRS, APPEND_DATA, WRITE_OWNER]
Owner~Principal: true
```
The test program could also delete the file afterwards. But when I disabled
the deletion and inspected the file manually, I noticed something odd --
Windows Explorer shows only write permissions for the user, and none for
reading:
Apparently, READ_DATA is missing, but from the code, that was unexpected. So
I added `neededPermissions.add(AclEntryPermission.READ_DATA);` as a test, and
then it worked. The reason for this behavior seems to be the declaration of
LIST_DIRECTORY: `Permission to list the entries of a directory (equal to {@link
#READ_DATA})`.
I'm not very familiar with Windows ACLs, so I can't say what the ideal set
of permissions is. But maybe `LIST_DIRECTORY` is only relevant for directories?
Also, is the removed `DELETE_CHILD` relevant for a file at all?
Not a functional problem, but does it make sense to generate empty ALLOW
ACLs for all non-matching users/groups in the first place? Why not simply
drop/remove them altogether, only keeping the other types and the new single
ALLOW rule?
Another thought - maybe it would also be a good idea to add an API-level
flag to enable/disable these permission modifications completely. For default
use cases, restricting these permissions seems like a good idea, but depending
on the application's setup, it may not fit. Something like
`.setRestrictHostKeyFilePermissions(bool)`, with a default of "true", maybe?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
