access denied on Windows

[rudi-bruchez]

Hello,

After mounting, I can create directories, but can't copy files. Access denied, on NTFS. I have seen your issue on WinFsp, but didn't find the solution around there. Should I mount it using a specific uid/gid ?
Also, I can see the drive letter only in normal mode, not in administrator mode. If I mount it in an elevated shell, I can see it only from applications running in elevated mode.

If you can just guide me as how to do it, that would save me from further digging. Thank you !

securefs 0.8.3
Crypto++ 7
WinFsp 1.4

[netheril96]

I have seen your issue on WinFsp, but didn't find the solution around there

Are you referring to this issue <winfsp/winfsp#45>? It has been fixed in latest WinFsp. Your case may be different, so I need more information. Also, I can see the drive letter only in normal mode, not in administrator

mode. If I mount it in an elevated shell, I can see it only from applications running in elevated mode.

It is by design---only the user who mounts the system is able to access the system.. Handling different user permissions is error prone from a user space program, so I don't do it at all.

…

On Fri, Apr 12, 2019 at 11:20 PM Rudi Bruchez ***@***.***> wrote: Hello, After mounting, I can create directories, but can't copy files. Access denied, on NTFS. I have seen your issue on WinFsp, but didn't find the solution around there. Should I mount it using a specific uid/gid ? Also, I can see the drive letter only in normal mode, not in administrator mode. If I mount it in an elevated shell, I can see it only from applications running in elevated mode. If you can just guide me as how to do it, that would save me from further digging. Thank you ! securefs 0.8.3 Crypto++ 7 WinFsp 1.4 — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#76>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAzE59dLAl46oT6xVo8dqH5XvgX1Uhnwks5vgKQ0gaJpZM4csXOT> .

[rudi-bruchez]

I am mounting the fs like this :
.\securefs mount C:\Users\rudi\Dropbox.Secret t: --trace -v --log c:\opt\securefs.log

[Verbose] [0000000000001FA0] [2019-04-13 09:57:19.900787600 UTC] Filesystem parameters: format version 4, block size 4096 (bytes), iv size 12 (bytes)

When I try to create a directory, I get an exception :
mkdir test1
mkdir : L'accès au chemin d'accès 'test1' est refusé. (in French, sorry, means Access Denied)
Au caractère Ligne:1 : 1

• mkdir test1

•   + CategoryInfo          : PermissionDenied: (T:\test1:String) [New-Item], UnauthorizedAccessException          
    + FullyQualifiedErrorId : CreateDirectoryUnauthorizedAccessError,Microsoft.PowerShell.Commands.NewItemCommand  
  
  

But the directory is created nevertheless...

If I try to copy a file from another drive, it fails the same, and the file is not copied.

The only interesting thing I can see from the log is :
stat (/test1): mode=040755, uid=0, gid=0, size=0

Is it because uid=0, gid=0 ? Should I force a uid/gid manually ?

As far as I know, using an elevated prompt does not change the user, it just runs it as elevated, kind of like a sudo. For instance, if I mount the filesystem in an elevated prompt, I am still the owner of the directories I create inside the filesystem. I see this :

Path Owner Access

---

test TARDIS-RUDI\rudi Everyone Allow ReadAndExecute, Synchronize...
test1 TARDIS-RUDI\rudi Everyone Allow ReadAndExecute, Synchronize..

But I don't see the drive letter when I am in a unelevated shell.

Thanks,
Rudi

[netheril96]

May I have the full log? Remember to redact the master key, or recreate the repo when you store your actual secrets.

[rudi-bruchez]

securefs.log

[netheril96]

So test1 is mapped to NG7CFMJYSGHXQST2JH7I6HP9TRZJHR2TVS Can you take a look at C:\Users\rudi\Dropbox.Secret\NG7CFMJYSGHXQST2JH7I6HP9TRZJHR2TVS? Does it exist? What are its permissions? Can you copy file directly into it?

…

On Sat, Apr 13, 2019 at 11:14 PM Rudi Bruchez ***@***.***> wrote: securefs.log <https://github.com/netheril96/securefs/files/3076363/securefs.log> — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#76 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAzE5yK4F4YRFxCpbNE30c0HLLgkLJu3ks5vgfRdgaJpZM4csXOT> .

[rudi-bruchez]

I see the directory flagged as read-only in the Windows Explorer properties dialog box, but I don't see such a property while querying the folder with commad-line tools (Powershell). It gives me that :

Mode : da----
BaseName : MGXYVT6AR99DJ3FWBDQG98BK8VCNSF3W
Target : {}
LinkType :
Name : MGXYVT6AR99DJ3FWBDQG98BK8VCNSF3W
FullName : C:\XXX.Secret\MGXYVT6AR99DJ3FWBDQG98BK8VCNSF3W
Parent : .Secret
Exists : True
Root : C:
Extension :
CreationTime : 12/04/2019 16:57:11
CreationTimeUtc : 12/04/2019 14:57:11
LastAccessTime : 12/04/2019 16:57:11
LastAccessTimeUtc : 12/04/2019 14:57:11
LastWriteTime : 12/04/2019 16:57:11
LastWriteTimeUtc : 12/04/2019 14:57:11
Attributes : Directory, Archive

Owner : BUILTIN\Administrateurs
Group : TARDIS-RUDI\rudi
Access : {System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule,
System.Security.AccessControl.FileSystemAccessRule}
Sddl : O:BAG:S-1-5-21-1359355473-3497660239-2560951646-1001D:(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;FA;;;S
-1-5-21-1359355473-3497660239-2560951646-1001)
AccessToString : AUTORITE NT\Système Allow FullControl
BUILTIN\Administrateurs Allow FullControl
TARDIS-RUDI\rudi Allow FullControl
AuditToString :
AccessRightType : System.Security.AccessControl.FileSystemRights
AccessRuleType : System.Security.AccessControl.FileSystemAccessRule
AuditRuleType : System.Security.AccessControl.FileSystemAuditRule
AreAccessRulesProtected : False
AreAuditRulesProtected : False
AreAccessRulesCanonical : True
AreAuditRulesCanonical : True

I should have full control over it. If I look at folders stored in a encfsmp forlder, the also show the read-only flag in the dialog box. I see no difference. It is stored in a Dropbox folder.

When I try to create the secret directory in my Documents, or any folder out of Dropbox, as a user (without elevated privileges), I get a Access Denied when trying to write anything in the mounted drive (mkdir), while the ACL seem OK :

PSPath : Microsoft.PowerShell.Core\FileSystem::T:
PSParentPath :
PSChildName : T:
PSDrive : T
PSProvider : Microsoft.PowerShell.Core\FileSystem
CentralAccessPolicyId :
CentralAccessPolicyName :
Path : Microsoft.PowerShell.Core\FileSystem::T:
Owner : TARDIS-RUDI\rudi
Group : TARDIS-RUDI\rudi
Access : {System.Security.AccessControl.FileSystemAccessRule, System.Security.AccessControl.FileSystemAccessRule}
Sddl : O:S-1-5-21-1359355473-3497660239-2560951646-1001G:S-1-5-21-1359355473-3497660239-2560951646-1001D:P(A;;0x1
200a9;;;WD)(A;;0x1f01b9;;;S-1-5-21-1359355473-3497660239-2560951646-1001)
AccessToString : Tout le monde Allow ReadAndExecute, Synchronize
TARDIS-RUDI\rudi Allow WriteExtendedAttributes, WriteAttributes, Delete, ReadAndExecute,
ChangePermissions, TakeOwnership, Synchronize
AuditToString :
AccessRightType : System.Security.AccessControl.FileSystemRights
AccessRuleType : System.Security.AccessControl.FileSystemAccessRule
AuditRuleType : System.Security.AccessControl.FileSystemAuditRule
AreAccessRulesProtected : True
AreAuditRulesProtected : False
AreAccessRulesCanonical : True
AreAuditRulesCanonical : True

I will try to install manually the last version of WinFsp, I used chocolatey to install it, I don't know if it could mess something up.

And, yes, I can copy files directly into the .Secret directory, no problem.