Git installer spoils ACL of %TEMP% on Win7

[zavadovsky]

Hello.
I have Win7 x64 installed on disk D: and temporary dir on disk C:
Here part of env:

C:\>set
...
SystemDrive=D:
SystemRoot=D:\Windows
TEMP=C:\Temp
TMP=C:\Temp
...

Disk D: have standart Win7 ACLs, as created on Windows installation.
Disk C: have full access for everyone to all disk contents.
Here output of icacls utility on C:

C:\>icacls C:
C: Everyone:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>icacls C:\Temp
C:\Temp Everyone:(I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

Now I run Git installer. While installer unpacks Git files %TEMP%'s ACL is not touched(I repeatedly exec "icacls C:\Temp" during installation).
But after last installation stage(shortcuts creation, just before last page appears) %TEMP%'s ACL becames this:

C:\>icacls C:\Temp
C:\Temp NULL SID:(DENY)(Rc,S,RD)
        YANCHIK\Yan:(F)
        YANCHIK\None:(RX,W)
        Everyone:(RX,W)
        NULL SID:(OI)(CI)(IO)(DENY)(Rc,S)
        CREATOR OWNER:(OI)(CI)(IO)(DENY)(S,RD,WD,AD,REA,WEA,X,DC)
        CREATOR OWNER:(OI)(CI)(IO)(D,Rc,WDAC,WO,RA,WA)
        CREATOR GROUP:(OI)(CI)(IO)(DENY)(W,RD,REA,X,DC)
        CREATOR GROUP:(OI)(CI)(IO)(Rc,S,RA)
        Everyone:(OI)(CI)(IO)(RX,W)

Successfully processed 1 files; Failed processing 0 files

Git version: v2.4.2.windows.1 57190ae
Tried Git-2.4.2.1-release-candidate-64-bit.exe and PortableGit-2.4.2.1-release-candidate-64-bit.7z.exe
Portable setup have same behavior - while unpacking ACL is good. And before SFX closes ACL is spoiled.

[dscho]

Hmm. I thought that the noacl attribute in /etc/fstab would prevent that from happening. Could you install the Git SDK, delete said attribute from the line

none / cygdrive binary,posix=0,noacl,user 0 0

in /etc/fstab, then build a new installer and test again?

[zavadovsky]

I install Git SDK on my another Win7 machine which is installed in standart way(C:\Windows, C:\Users\...\Local\Temp). All ACLs made by Windows.
And get temp's ACL is spoiled same way.
I restore ACL(delete all odd records and set "Inherit from parent" property).
Run Git SDK through desktop shortcut. ACL is spoiled again.
Here normal:

C:\Users\Yan\AppData\Local>icacls .\Temp
.\Temp NT AUTHORITY\system:(I)(OI)(CI)(F)
       BUILTIN\Administrators:(I)(OI)(CI)(F)
       Yan-PC\y_zavadovskiy:(I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

Here after running D:\git-sdk-64\git-bash.exe through shortcut:

C:\Users\Yan\AppData\Local>icacls .\Temp
.\Temp NULL SID:(DENY)(Rc,S,RD,REA,WEA,X,DC)
       Yan-PC\y_zavadovskiy:(F)
       Yan-PC\None:(RX,W)
       NT AUTHORITY\system:(RX,W)
       BUILTIN\Administrators:(RX,W)
       Everyone:(RX,W)
       NULL SID:(OI)(CI)(IO)(DENY)(Rc,S,DC)
       CREATOR OWNER:(OI)(CI)(IO)(F)
       NT AUTHORITY\system:(OI)(CI)(IO)(DENY)(S,X)
       BUILTIN\Administrators:(OI)(CI)(IO)(DENY)(S,X)
       CREATOR GROUP:(OI)(CI)(IO)(Rc,S,RA)
       NT AUTHORITY\system:(OI)(CI)(IO)(RX,W)
       BUILTIN\Administrators:(OI)(CI)(IO)(RX,W)
       Everyone:(OI)(CI)(IO)(Rc,S,RA)

Spoiled ACL from my first message prevents software from using temp directory("Access denied" on file creation attempts etc).
Spoiled ACL from this post don't prevent.
I think this is the reason why nobody reports this bug before.

Next I go to d:\git-sdk-64\etc\fstab and modify it:

$ diff -u /etc/fstab.orig /etc/fstab
--- /etc/fstab.orig     2015-06-12 02:19:06.011861600 +0300
+++ /etc/fstab  2015-06-12 02:20:50.855063200 +0300
@@ -2,5 +2,5 @@
 # http://cygwin.com/cygwin-ug-net/using.html#mount-table

 # DO NOT REMOVE NEXT LINE. It remove cygdrive prefix from path
-none / cygdrive binary,posix=0,noacl,user 0 0
+none / cygdrive binary,posix=0,user 0 0
 none /tmp usertemp binary,posix=0 0 0

It is don't help. Starting git-bash.exe spoils temp ACL.

Next I try this:

y_zavadovskiy@Yan-PC MINGW64 /
$ diff -u /etc/fstab.orig /etc/fstab
--- /etc/fstab.orig     2015-06-12 02:19:06.011861600 +0300
+++ /etc/fstab  2015-06-12 02:23:00.277282100 +0300
@@ -3,4 +3,4 @@

 # DO NOT REMOVE NEXT LINE. It remove cygdrive prefix from path
 none / cygdrive binary,posix=0,noacl,user 0 0
-none /tmp usertemp binary,posix=0 0 0
+none /tmp usertemp binary,posix=0,noacl 0 0

And it helps.
Next I build portable installer(as I wrote - it's also buggy) with this fstab and test it on both my Win7 machines. It works good. Temp dir access rights not touched after running git-bash.exe.
I think this is the solution - add noacl to usertemp mounting options.

[dscho]

Excellent analysis. Would you care to open a Pull Request, fixing this line with a nice, concise summary of your analysis as commit message? I would really appreciate that.

[calle2010]

I have used only the portable version of Git for Windows 2 so far and the SDK installer, both installed on system drive C:, but it seems the issue also hit me. Microsoft Message Analyzer refuses to start with exception:

Access to the path 'C:\Users\christian.schaefer\AppData\Local\Temp\MessageAnalyzer' is denied

This is the output of icacls %TEMP% from regular CMD.EXE window, user and computer names removed:

C:\Users\SECRET\AppData\Local\Temp NULL SID:(DENY)(Rc,S,RD,REA,WEA,X,DC)
                                     DIR\my.user.name:(F)
                                     DIR\Domain Users:(RX,W)
                                     NT AUTHORITY\SYSTEM:(RX,W)
                                     BUILTIN\Administrators:(RX,W)
                                     Everyone:(RX,W)
                                     NULL SID:(OI)(CI)(IO)(DENY)(Rc,S,DC)
                                     CREATOR OWNER:(OI)(CI)(IO)(F)
                                     NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(DENY)(S,X)
                                     BUILTIN\Administrators:(OI)(CI)(IO)(DENY)(S,X)
                                     CREATOR GROUP:(OI)(CI)(IO)(Rc,S,RA)
                                     NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(RX,W)
                                     BUILTIN\Administrators:(OI)(CI)(IO)(RX,W)
                                     Everyone:(OI)(CI)(IO)(Rc,S,RA)

Successfully processed 1 files; Failed processing 0 files

[dscho]

FWIW this fix is part of the 2nd release candidate at https://git-for-windows.github.io/#download.

[zavadovsky]

Researched a few more.
"Maker-of-evil" is here:

  /usr/bin/chmod 1777 /tmp 2>/dev/null

Commenting this line also fixes this issue.
But in my opinion adding noacl is better - it's prevent anyone from doing strange things with permissions on TEMP.