[jira] [Commented] (DAEMON-450) Invoked "bin\tomcat9 //US/Tomcat9", logs directory will be inserted unwanted two ACLs

2022-11-24 Thread Norimasa Yamamoto (Jira) 


[ 
https://issues.apache.org/jira/browse/DAEMON-450?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17638429#comment-17638429
 ] 

Norimasa Yamamoto commented on DAEMON-450:
--

I red the diff.

It will be missing the NULL iinitialization for doing ”cleanup” block.

Sorry if you were already fixed.

> Invoked "bin\tomcat9 //US/Tomcat9", logs directory will be inserted unwanted 
> two ACLs
> -
>
> Key: DAEMON-450
> URL: https://issues.apache.org/jira/browse/DAEMON-450
> Project: Commons Daemon
>  Issue Type: Bug
>  Components: prunsrv
>Affects Versions: 1.3.2
> Environment: Windows 7 SP1 x64
> Apache Tomcat 9.0.69 x86 (zip-dist)
>  
>Reporter: Norimasa Yamamoto
>Priority: Major
> Fix For: 1.3.3
>
>
> Invoked "bin\tomcat9 //US/Tomcat9", logs directory will be inserted unwanted 
> two ACLs.
> Repro at Tomcat9 directory on Admin Command Prompt (not Admin PowerShell).
> > ren logs logs1
> > md logs
> > icacls logs
> logs NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)
> > bin\tomcat9.exe //US/Tomcat9
> > icacls logs
> logs NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)
> > bin\tomcat9.exe //US/Tomcat9
> > icacls logs
> logs NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)
> > for /l %i in (1,0,1) do bin\tomcat9.exe //US/Tomcat9
>   : (...after 1000-2000 times...)
> [2022-11-18 17:46:20] [warn]  [ 2456] Failed to grant service user 'NT 
> AUTHORITY\LocalService' write permissions to log path 
> '\logs' due to error '1340: The inherited access 
> control list (ACL) or access control entry (ACE) could not be built.'
>   :
> > icacls logs
> logs NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>   :
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

[jira] [Commented] (DAEMON-450) Invoked "bin\tomcat9 //US/Tomcat9", logs directory will be inserted unwanted two ACLs

2022-11-22 Thread Mark Thomas (Jira) 


[ 
https://issues.apache.org/jira/browse/DAEMON-450?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17637393#comment-17637393
 ] 

Mark Thomas commented on DAEMON-450:


The original report was for Windows 7 which is no longer supported.

This behaviour is not observed with a fully patched Windows 8.1 or fully 
patched Windows 10. I can repeat this with Windows Server 2012.

I'll take a look at the proposed patch.

> Invoked "bin\tomcat9 //US/Tomcat9", logs directory will be inserted unwanted 
> two ACLs
> -
>
> Key: DAEMON-450
> URL: https://issues.apache.org/jira/browse/DAEMON-450
> Project: Commons Daemon
>  Issue Type: Bug
>  Components: prunsrv
>Affects Versions: 1.3.2
> Environment: Windows 7 SP1 x64
> Apache Tomcat 9.0.69 x86 (zip-dist)
>  
>Reporter: Norimasa Yamamoto
>Priority: Major
>
> Invoked "bin\tomcat9 //US/Tomcat9", logs directory will be inserted unwanted 
> two ACLs.
> Repro at Tomcat9 directory on Admin Command Prompt (not Admin PowerShell).
> > ren logs logs1
> > md logs
> > icacls logs
> logs NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)
> > bin\tomcat9.exe //US/Tomcat9
> > icacls logs
> logs NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)
> > bin\tomcat9.exe //US/Tomcat9
> > icacls logs
> logs NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)
> > for /l %i in (1,0,1) do bin\tomcat9.exe //US/Tomcat9
>   : (...after 1000-2000 times...)
> [2022-11-18 17:46:20] [warn]  [ 2456] Failed to grant service user 'NT 
> AUTHORITY\LocalService' write permissions to log path 
> '\logs' due to error '1340: The inherited access 
> control list (ACL) or access control entry (ACE) could not be built.'
>   :
> > icacls logs
> logs NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>   :
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

[jira] [Commented] (DAEMON-450) Invoked "bin\tomcat9 //US/Tomcat9", logs directory will be inserted unwanted two ACLs

2022-11-21 Thread Norimasa Yamamoto (Jira) 


[ 
https://issues.apache.org/jira/browse/DAEMON-450?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17637016#comment-17637016
 ] 

Norimasa Yamamoto commented on DAEMON-450:
--

Easy fix for above. (only changing GRANT_ACCESS to SET_ACCESS in 
src\native\windows\src\security.c)

However, still have two leaks at GetNamedSecurityInfoW's pSD and 
SetEntriesInAcl's pNewDACL.
They will need to free by LocalFree. see C++ sample.
https://learn.microsoft.com/en-us/windows/win32/secauthz/modifying-the-acls-of-an-object-in-c--

--- security.c  Sun Sep 18 13:49:42 2022
+++ security.c  Tue Nov 22 14:15:13 2022
@@ -81,5 +81,5 @@
 ZeroMemory(, sizeof(EXPLICIT_ACCESS));
 ea.grfAccessPermissions = GENERIC_EXECUTE + GENERIC_READ + GENERIC_WRITE;
-ea.grfAccessMode = GRANT_ACCESS;
+ea.grfAccessMode = SET_ACCESS;
 ea.grfInheritance = CONTAINER_INHERIT_ACE + OBJECT_INHERIT_ACE;
 ea.Trustee.TrusteeForm = TRUSTEE_IS_NAME;


> Invoked "bin\tomcat9 //US/Tomcat9", logs directory will be inserted unwanted 
> two ACLs
> -
>
> Key: DAEMON-450
> URL: https://issues.apache.org/jira/browse/DAEMON-450
> Project: Commons Daemon
>  Issue Type: Bug
>  Components: prunsrv
>Affects Versions: 1.3.2
> Environment: Windows 7 SP1 x64
> Apache Tomcat 9.0.69 x86 (zip-dist)
>  
>Reporter: Norimasa Yamamoto
>Priority: Major
>
> Invoked "bin\tomcat9 //US/Tomcat9", logs directory will be inserted unwanted 
> two ACLs.
> Repro at Tomcat9 directory on Admin Command Prompt (not Admin PowerShell).
> > ren logs logs1
> > md logs
> > icacls logs
> logs NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)
> > bin\tomcat9.exe //US/Tomcat9
> > icacls logs
> logs NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)
> > bin\tomcat9.exe //US/Tomcat9
> > icacls logs
> logs NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)
> > for /l %i in (1,0,1) do bin\tomcat9.exe //US/Tomcat9
>   : (...after 1000-2000 times...)
> [2022-11-18 17:46:20] [warn]  [ 2456] Failed to grant service user 'NT 
> AUTHORITY\LocalService' write permissions to log path 
> '\logs' due to error '1340: The inherited access 
> control list (ACL) or access control entry (ACE) could not be built.'
>   :
> > icacls logs
> logs NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>   :
>  NT AUTHORITY\LOCAL SERVICE:(RX,W)
>  NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)(GR,GW,GE)
>  NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(M)
>  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
>  BUILTIN\Administrators:(I)(OI)(CI)(F)
>  BUILTIN\Users:(I)(OI)(CI)(M)



--
This message was sent by Atlassian Jira
(v8.20.10#820010)