Immediately upon upgrading to THg 6.3.2 (Windows, x64) I get a permission denied error regarding the TortoiseHgOverlayServer
The message box reads:
---------------------------
Errors in 'TortoiseHgOverlayServer.exe'
---------------------------
The logfile 'C:\ProgramData\TortoiseHg\TortoiseHgOverlayServer.log' could not be opened:
[Errno 13] Permission denied: 'C:\\ProgramData\\TortoiseHg\\TortoiseHgOverlayServer.log'
---------------------------
OK
---------------------------
I don't know if this will be a one-time issue or points to some deeper issue. Anyway, looking at it with PowerShell we can see:
Security descriptor of C:\ProgramData\TortoiseHg\TortoiseHgOverlayServer.log
NB: These are all inherited from C:\ProgramData
, btw.
$ (Get-Acl -Path C:\ProgramData\TortoiseHg\TortoiseHgOverlayServer.log).sddl
O:BAG:S-1-5-21-1956275055-2109141404-336736917-513D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;0x1200a9;;;BU)
In all likelihood the file got created by an elevated process, which makes sense. Thus the file is owned by the BUILTIN\Administrators
alias (BA
) and the Group is set to S-1-5-21-1956275055-2109141404-336736917-513
(None
group, local to my machine). The ACEs are all inherited (ID
):
-
O:BA
-> Owner:BUILTIN\Administrators
-
G:S-1-5-21-1956275055-2109141404-336736917-513
-> Group:.\None
(this is irrelevant and was introduced for POSIX compatibility originally) -
D:AI
(DACL, auto-inherited)-
(A;ID;FA;;;SY)
-> Allow (inherited), File All (access) toNT AUTHORITY\SYSTEM
(SY
) -
(A;ID;FA;;;BA)
-> Allow (inherited), File All (access) toBUILTIN\Administrators
(BA
) -
(A;ID;0x1200a9;;;BU)
-> Allow (inherited), File Generic Read (access, == mask 0x1200a9) toBUILTIN\Users
(BU
)- Hope I am getting it right, but I think that
0x1200a9
means:-
FILE_READ_DATA | FILE_READ_EA
==0x000009
-
FILE_EXECUTE | FILE_READ_ATTRIBUTES
==0x0000a0
-
READ_CONTROL
==0x020000
-
SYNCHRONIZE
==0x100000
- All
or
-d together defined asFILE_GENERIC_READ
in a number of Windows headers
-
- Hope I am getting it right, but I think that
-
So we need to look further up the chain ...
Security descriptor of C:\ProgramData\TortoiseHg
NB: These are all inherited from C:\ProgramData
, btw.
$ (Get-Acl -Path C:\ProgramData\TortoiseHg).sddl
O:S-1-5-21-1956275055-2109141404-336736917-1001G:S-1-5-21-1956275055-2109141404-336736917-513D:AI(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;ID;FA;;;S-1-5-21-1956275055-2109141404-336736917-1001)(A;OICIIOID;GA;;;CO)(A;OICIID;0x1200a9;;;BU)(A;CIID;DCLCRPCR;;;BU)
-
O:S-1-5-21-1956275055-2109141404-336736917-1001
-> Owner: local user with RID=1001 (that's my own user account) -
G:S-1-5-21-1956275055-2109141404-336736917-513
-> Group:.\None
-
D:AI
-
(A;OICIID;FA;;;SY)
-> Allow (inherited and propagating down with object inheritance [OI
] and container inheritance [CI
]), File All (access) toNT AUTHORITY\SYSTEM
(SY
) [This folder, subfolders and files] -
(A;OICIID;FA;;;BA)
-> Allow (inherited and propagating down with object inheritance [OI
] and container inheritance [CI
]), File All (access) toBUILTIN\Administrators
(BA
) [This folder, subfolders and files] -
(A;ID;FA;;;S-1-5-21-1956275055-2109141404-336736917-1001)
-> Allow (inherited), Full File (access) to my local user [This folder only] -
(A;OICIIOID;GA;;;CO)
-> Allow (inherited and propagating down with object inheritance [OI
] and container inheritance [CI
], inheritance only [IO
]), Generic All (access) toCREATOR OWNER
(CO
, which refers to the Owner shown above) [Subfolders and files only] -
(A;OICIID;0x1200a9;;;BU)
-> Allow (inherited and propagating down with object inheritance [OI
] and container inheritance [CI
]), File Generic Read (access, see above) toBUILTIN\Users
(BU
) [This folder, subfolders and files] -
(A;CIID;DCLCRPCR;;;BU)
-> Allow (inherited and propagating down with container inheritance [CI
]),DCLCRPCR
(see below) [This folder and subfolders]-
DC
== Delete Contents (both leaf and container objects) -
LC
== List Contents -
RP
== Read Properties -
CR
== All Extended Rights
-
-
Observation
While the container object (C:\ProgramData\TortoiseHg
) allows creation of leaf and container child objects to CREATOR OWNER
or BUILTIN\Administrators
, there is no other ACE that would allow writing to such a created leaf object. This would have to be set during creation from elevated context, using LPSECURITY_ATTRIBUTES
.
Conclusion
Thus C:\ProgramData\TortoiseHg
should at least add an ACE of its own to the inherited ACEs, which grants BUILTIN\Users
(BU
) at least write, if not full, access. Local ACEs take precedence over more distant ones, which is why this would work.
Adding and ACE (A;OICI;FA;;;BU)
(or (A;OICI;FW;;;BU)
) to C:\ProgramData\TortoiseHg
prior to any object creation inside, should fix this.
No clue how to achieve this in Python -- yet -- but I know how to do it in C# and C++ and in terms of SDDL, using PowerShell, say.
Regarding SDDL:
- https://learn.microsoft.com/en-us/windows/win32/secauthz/ace-strings
- https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
- https://devblogs.microsoft.com/oldnewthing/20220510-00/?p=106640
- https://clan8blog.wordpress.com/2016/08/08/sddl-explained/