[OpenAFS] OpenAFS installation messes up Windows 8 file access control

Mon, 23 Sep 2013 08:21:13 -0400

This is a cryptographically signed message in MIME format.

--------------ms020704060202070405060201
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On 9/18/2013 8:17 PM, Tim Adye wrote:
> Hi Jeffrey,
>=20
> Jeffrey Altman <jaltman@secure-endpoints.com> wrote on 16 September 201=
3:
>>
>> if you are experiencing undesirable behavior on paths located in the A=
FS
>> name space then the afs redirectorcan be involved.  if the path is loc=
al
>> disk or CIFS then the redirector cannot b The Windows Multiple UNC
>> provider simply will not send those file system operations to the afs
>> file system.
>=20
> Yes, the problem is on my local disk (eg. C:\Program Files). It's just =
the installation of OpenAFS that provokes it.

An installation of OpenAFS consists of:

 1. two device drivers
 2. the three shell extensions in both x86 and x64 variants
 3. the network provider in both x86 and x64 variants
 4. the authentication provider
 5. the service
 6. the smb pipe service emulators

>> i can certainly believe that the explorer shell has bugs that are
>> triggered by the mere existence of a non Microsoft file system.  The
>> explorer shell has a lot of hard coded assumptions that require NTFS o=
r
>> CIFS.  this is part of the reason that their new ReFS file system is n=
ot
>> supported on client systems.
>=20
> If the installer isn't messing with Explorer's permissions settings, th=
en the presence of the OpenAFS IFS does sound like the likely "culprit" f=
or provoking an Explorer bug. I have installed some other IFS systems on =
my machine, but it looks like only OpenAFS causes the problem.

what other IFSs have you installed?  Are they network file systems?   Do
they provide all of the system components that OpenAFS provides?

> Can I test this by uninstalling or disabling the OpenAFS IFS alone? I c=
an switch off all the OpenAFS programs (with autoruns and the Services co=
ntrol panel), but the problem remains. It takes a full OpenAFS uninstall =
to cure it. It would narrow down the problem if I can disable or uninstal=
l just the IFS and check if that is the crucial step.

The device drivers can be disabled in the registry

  HKLM\SYSTEM\CurrentControlSet\Services\AFSRedirector
  HKLM\SYSTEM\CurrentControlSet\Services\AFSLibrary

The "Start" parameter determines whether or not (and when) the driver is
loaded.   A value of "4" disables the device driver.  The service will
switch to SMB mode if the drivers are not available.   SMB mode requires
the "microsoft loopback" adapter be installed.

The service is

  HKLM\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemon

>> it is also possible that another file system filter installed on the
>> machine is altering the return code which prevents user account contro=
l
>> from be triggered.   however, it sounds like the real problem is that
>> the explorer shell thinks the volume you are working on is readonly an=
d
>> therefore decides to hide the UI controls.
>=20
> The symptoms are a little different from a read-only device. For exampl=
e, the delete button is not greyed out, and attempting to delete a file s=
till brings up the "are you sure you want to move this to the recycle bin=
" prompt (if delete prompts are enabled) before silently failing. I just =
checked with a read-only SD card and the behaviour is different there.

What are the differences in behavior as viewed by SysInternals Process
Monitor?

>> this would be an explorer shell bug which must be addressed by Microso=
ft.
>=20
> That does seem likely, but how to get them to do so? Tracking down a mo=
re specific cause would probably help. I don't know the best forum/way to=
 report a Windows bug.

Reporting bugs to Microsoft requires a Professional Support Contract for
the operating system in question or payment for a support incident.

> If it's not some combination of things on my specific system, then ever=
yone who installs OpenAFS on Windows 8 (64 bit? Standard Edition?) will h=
it this really annoying problem. Is it just me? Does anyone else here see=
 it? I was "lucky" to spot that it appeared when I installed OpenAFS; man=
y people might not. I'm planning on upgrading to Windows 8 Pro, so I hope=
 soon to see if the issue is specific to the Standard Edition.

None of YFSI's support customers have complained about this behavior.
That being said, none of our support customers are deploying Windows 8
in a production end user environment.

>=20
> Thanks,
> Tim.
>=20
>> Jeffrey Altman
>>
>> On 9/15/2013 10:03 PM, Tim Adye wrote:
>>> Hi Jeffrey,
>>>
>>> Thanks for the information.
>>>
>>>> The only interaction between OpenAFS and the Explorer Shell is the "=
AFS
>>>> Shell Extension" which provides the "AFS Context Menu", the "AFS
>>>> Property Sheets", and "Mount Point and Symlink Overlay Icons".  This=
 is
>>>> the functionality you would have disabled using "autoruns".
>>>
>>> Yes, I tried disabling all of those, but that didn't help.
>>>
>>> If, as you suggest, it isn't OpenAFS running, then there must be
>> something that the OpenAFS installer and uninstaller do to affect Wind=
ows
>> Explorer. I installed and uninstalled OpenAFS many times (often with n=
o
>> other action except for the reboot) and the problematic behaviour I
>> described appeared if, and only if, OpenAFS was installed (whether run=
ning
>> or not).
>>>
>>> Could there be some local policy or groups that are changed by the
>> installer? I know that it adds the "AFS Client Admins" group, though t=
hat
>> can't be it as the uninstaller doesn't remove the group.
>>>
>>> Thanks,
>>> Tim.
>>>
>>> -----Original Message-----
>>> From: Jeffrey Altman [mailto:jaltman@secure-endpoints.com]
>>> Sent: 15 September 2013 23:35
>>> To: Adye, Tim (STFC,RAL,PPD)
>>> Cc: openafs-info@openafs.org
>>> Subject: Re: [OpenAFS] OpenAFS installation messes up Windows 8 file
>> access control
>>>
>>> Tim,
>>>
>>> I'm sorry you are experiencing a problem but the reason you didn't fi=
nd
>>> any changes that were made by OpenAFS is because OpenAFS doesn't make=

>>> any changes.
>>>
>>> The only interaction between OpenAFS and the Explorer Shell is the "A=
FS
>>> Shell Extension" which provides the "AFS Context Menu", the "AFS
>>> Property Sheets", and "Mount Point and Symlink Overlay Icons".  This =
is
>>> the functionality you would have disabled using "autoruns".
>>>
>>> Jeffrey Altman
>>>
>>> On 9/15/2013 4:08 PM, Tim Adye wrote:
>>>> Hi,
>>>>
>>>> The OpenAFS client installation is doing something nasty to the file=

>> access
>>>> control on my Windows 8 system. After installing OpenAFS, I can no
>> longer
>>>> move, copy, or delete files with the File Explorer in local Windows
>> folders
>>>> that require administrator privileges.
>>>>
>>>> What should happen, and happens again if I uninstall OpenAFS, is tha=
t I
>> get
>>>> a pop-up message such as "File Access Denied: You'll need to provide=

>>>> administrator permission to copy to this folder". I can then then
>> select
>>>> "Continue" (perhaps needing an admin password) to copy the file.
>>>>
>>>> When OpenAFS is installed, there is no pop-up message and the copy
>> silently
>>>> fails. This occurs with drag-and-drop and Ctrl/C+X+V copy and move, =
and
>>>> deleting with the "Delete" key or button. Oddly, the pop-up message
>> does
>>>> appear when creating or renaming a file or folder, so those operatio=
ns
>> still
>>>> work. It is also possible to delete files from the context menu (whi=
ch
>> show
>>>> the admin icon and don't normally require confirmation).
>>>>
>>>> This is a problem with Windows Explorer (now called File Explorer in=

>> Windows
>>>> 8) and seemingly nothing to do with OpenAFS, except that it occurs
>> whenever
>>>> OpenAFS is installed. I can fix the problem by uninstalling OpenAFS,=

>> and the
>>>> problem comes back when I reinstall OpenAFS. I tried disabling all t=
he
>>>> OpenAFS components with "autoruns" (and restarting), but the problem=

>>>> remained. So I guess it is some change made by the OpenAFS installat=
ion
>>>> program. What changes does it make to the Windows Account Control an=
d
>>>> authorisation systems that might cause such an issue? I tried compar=
ing
>>>> registry dumps before and after uninstalling OpenAFS, but didn't see=

>>>> anything obvious.
>>>>
>>>> I used the standard OpenAFS IFS install and all the default options
>> (all
>>>> enabled, except integrated login), but it didn't help to disable the=

>> rest.
>>>>
>>>> I am using 64-bit Windows 8 Standard Edition (so I can't check for u=
ser
>> or
>>>> group policy changes, since that control panel requires Windows 8 Pr=
o).
>> I
>>>> installed 64-bit OpenAFS 1.7.2600, but had the same problem with an
>> older
>>>> version, 1.7.0800, that does not give me this problem on a Windows 7=

>> Pro
>>>> system. So, it could be Windows 8 (vs 7) or Standard Edition (vs Pro=
).
>>>>
>>>> Does anyone have any ideas? I would be very grateful for any fix or
>>>> work-around. With OpenAFS installed, it is extremely cumbersome to m=
ake
>> any
>>>> program file changes on my system. The only way I have to copy or mo=
ve
>>>> program files in Windows Explorer is by taking ownership and changin=
g
>> the
>>>> permissions on all directories and files involved, making the move, =
and
>>>> restoring the original permissions - a cumbersome and risky operatio=
n.
>> Or
>>>> else to do everything from the command-line from an Admin account.
>>>>
>>>> Thanks,
>>>> Tim.
>>>>
>>>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D  cut here  =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>>>>  Tim Adye      T.J.Adye@rl.ac.uk       http://hepunx.rl.ac.uk/~adye
>>>>  ATLAS Group,  Particle Physics Dept,  Rutherford Appleton Lab
>>>>
>>>>
>>>
>>>
>=20
>=20

--------------ms020704060202070405060201
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIINITCC
BkIwggUqoAMCAQICEDirAC//rpa3Vv85Wvtd5xswDQYJKoZIhvcNAQEFBQAwgcoxCzAJBgNV
BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1
c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0
aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMSBQdWJsaWMgUHJp
bWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczMB4XDTExMDkwMTAwMDAwMFoXDTIx
MDgzMTIzNTk1OVowgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3Jh
dGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEeMBwGA1UECxMVUGVyc29u
YSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIEluZGl2aWR1YWwg
U3Vic2NyaWJlciBDQSAtIEc0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxuwn
/R1j9DsdisHTHMjIgoa2uEqGkqqBXHLKMA0vnkEiVzAhJZCao/SsKsaIF4ZhchN2LuwDyyeb
jyCAN+DkitpVplAP/LlcI2mJQqG6H6/vDvmkyQrx+DeyxtmSSq5937hEH5u6P4wG/tgjT0hR
I2pghKjuJy9g35byGiqMPI8AzE/L+iCOvDX24fCatgXz/B0/xhR7DtryBeTTgwKmxWlwtKnk
VunbHVz0pjbia7UeKi3cvrvuOgSwMAitX2hsxr0GloiE5+apZC28ODC7iCbDZ2ZmtLR3+cCh
xw5y72bi5bnK4POFdzWY3tQcsP5mceI4y258T0BV65fZqBge7QIDAQABo4ICRDCCAkAwOAYI
KwYBBQUHAQEELDAqMCgGCCsGAQUFBzABhhxodHRwOi8vcGtpLW9jc3AudmVyaXNpZ24uY29t
MBIGA1UdEwEB/wQIMAYBAf8CAQAwbAYDVR0gBGUwYzBhBgtghkgBhvhFAQcXATBSMCYGCCsG
AQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGguY29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRw
Oi8vd3d3LnN5bWF1dGguY29tL3JwYTA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnZl
cmlzaWduLmNvbS9wY2ExLWczLmNybDAOBgNVHQ8BAf8EBAMCAQYwKQYDVR0RBCIwIKQeMBwx
GjAYBgNVBAMTEVZlcmlTaWduTVBLSS0yLTk3MB0GA1UdDgQWBBSt+cOTci21uShh5KTXYNXE
Cl4aATCB8QYDVR0jBIHpMIHmoYHQpIHNMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVy
aVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsT
MShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBD
BgNVBAMTPFZlcmlTaWduIENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB
dXRob3JpdHkgLSBHM4IRAItbdVaEVIULAM+vOEjOsaQwDQYJKoZIhvcNAQEFBQADggEBANaP
wdqbiPKzbE0fWC+6AVFddMFG6MO4e5/WQPHv/zK6iWvADjRDn6SZ5qTwXUgzYoWFYf4jiCKM
YJsrnGVJlMSiOCRIpVylUEto6WIip5PomSJuPVu7EEIOH0x1RzRWCY/4vYw881y70pZwVHBi
Te/REL6dSCxe7IZrB4LwPeElJygs4BZ2HrP95WKW0oo9Xyuu+1zCE7dlY8s0dkOf1oeZq26t
lcEAP0Yngf813iMOQ9wUXzL5yinvwlIw9ZnduYH4OiUgjYJo8rkhhXRmBOGGORYy8i3WKqjJ
3tkAAk/jGCDFpYFWtpXe04Kt+HslvmR8LqC6cCz4+XXidE0HbYQwggbXMIIFv6ADAgECAhAl
sq27FC4B63Z8q1Jzxx+CMA0GCSqGSIb3DQEBBQUAMIGmMQswCQYDVQQGEwJVUzEdMBsGA1UE
ChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdv
cmsxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuU3ltYW50ZWMg
Q2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHNDAeFw0xMzAxMTUwMDAwMDBa
Fw0xNDAxMTYyMzU5NTlaMIHOMS4wLAYDVQQDDCVQZXJzb25hIE5vdCBWYWxpZGF0ZWQgLSAx
MzU4Mjc2MTA4NjMxMSswKQYJKoZIhvcNAQkBFhxqYWx0bWFuQHlvdXItZmlsZS1zeXN0ZW0u
Y29tMQ8wDQYDVQQLDAZTL01JTUUxHjAcBgNVBAsMFVBlcnNvbmEgTm90IFZhbGlkYXRlZDEf
MB0GA1UECwwWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEdMBsGA1UECgwUU3ltYW50ZWMgQ29y
cG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQChjpVdVk6XeKFff4To
xGglVcP3FVY95LfwfBUKbQKppRYgfKBFW1RIEG+KXpc3IGOOTUX0Lg1xaukRwuoqv/pqRMNK
JabXcr1RFuCFg9xfcmP5Z+65qQ+IRxYCKdcNfu3GdS7rMOY57+VLU7aZnnMgnt0oE42awze8
gYQSJsdjZKKZS9DBnzxJYfzqhIw7txoMdV7rwPAZm5yujsqI/eWuZPZ+qZ+8GTsnHJzZNvc6
KrDGU6aVfknM+qf92hXA2VXvmtf1B17BBbGX6Hgat71Ufw5oXFly6/Vt+e5mKIozXytw8qPX
NllsG89ITVzn0OovcpcSRFBrXanzVn7JVj33AgMBAAGjggLVMIIC0TAMBgNVHRMBAf8EAjAA
MA4GA1UdDwEB/wQEAwIFoDAgBgNVHSUBAf8EFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwHQYD
VR0OBBYEFMC1SMuRefXyNAwkZM+Lgu7iJ6nFMCcGA1UdEQQgMB6BHGphbHRtYW5AeW91ci1m
aWxlLXN5c3RlbS5jb20wHwYDVR0jBBgwFoAUrfnDk3IttbkoYeSk12DVxApeGgEwggErBggr
BgEFBQcBAQSCAR0wggEZMIIBFQYIKwYBBQUHMAKGggEHbGRhcDovL2RpcmVjdG9yeS52ZXJp
c2lnbi5jb20vQ04lMjAlM0QlMjBTeW1hbnRlYyUyMENsYXNzJTIwMSUyMEluZGl2aWR1YWwl
MjBTdWJzY3JpYmVyJTIwQ0ElMjAtJTIwRzQlMkMlMjBPVSUyMCUzRCUyMFBlcnNvbmElMjBO
b3QlMjBWYWxpZGF0ZWQlMkMlMjBPVSUyMCUzRCUyMFN5bWFudGVjJTIwVHJ1c3QlMjBOZXR3
b3JrJTJDJTIwTyUyMCUzRCUyMFN5bWFudGVjJTIwQ29ycG9yYXRpb24lMkMlMjBDJTIwJTNE
JTIwVVM/Y0FDZXJ0aWZpY2F0ZTtiaW5hcnkwXQYDVR0fBFYwVDBSoFCgToZMaHR0cDovL3Br
aS1jcmwuc3ltYXV0aC5jb20vY2FfNTYxYzEwMzY5MGM5N2E2OTI0N2EwZWYwNzFhYzgxYWYv
TGF0ZXN0Q1JMLmNybDBsBgNVHSAEZTBjMGEGC2CGSAGG+EUBBxcBMFIwJgYIKwYBBQUHAgEW
Gmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cu
c3ltYXV0aC5jb20vcnBhMCoGCmCGSAGG+EUBEAMEHDAaBhFghkgBhvhFARABAgIEAYazFxYF
MTA5MjIwDQYJKoZIhvcNAQEFBQADggEBAHVBsY+l21fY0twxzNnO0QbadbRT4n7k3rYfOMbP
noBDkYQx5lcrYn19f7e+ADMPdW/MY2ZjFM76aiRgiTo2IjMB7z4vyX6hfGJKTIHX9loDW0H2
z2o0jYqXDQtXx9A/gfMtVh9J+8O5IuCPsVtXgI4p6kRQHN+Er2Rzu1I4BILxE9HsDb/ruX6p
NXZSUQ2AcMP87ZVfz+reumMpJgWWAoiQWJCgp+qZ2c2AG+yV+FstiMpxIj/qB9+BrFRuam8d
IGbH0tIS2tyc7pgit8Pid2Zv7HGT2NFu69INsKIyqGImhMVuOUaCq/kNi3Z+6R5Hm3ljift8
ZF52Kiq4whe8KlcxggRSMIIETgIBATCBuzCBpjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5
bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMR4w
HAYDVQQLExVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMTLlN5bWFudGVjIENsYXNz
IDEgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBIC0gRzQCECWyrbsULgHrdnyrUnPHH4IwCQYF
Kw4DAhoFAKCCAmswGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcN
MTMwOTIzMTIyMTEzWjAjBgkqhkiG9w0BCQQxFgQUt2yzpjXIWzknsJXzez7AUf0JHRQwbAYJ
KoZIhvcNAQkPMV8wXTALBglghkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4G
CCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCB
zAYJKwYBBAGCNxAEMYG+MIG7MIGmMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMg
Q29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsT
FVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJbmRp
dmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHNAIQJbKtuxQuAet2fKtSc8cfgjCBzgYLKoZIhvcN
AQkQAgsxgb6ggbswgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3Jh
dGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazEeMBwGA1UECxMVUGVyc29u
YSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIEluZGl2aWR1YWwg
U3Vic2NyaWJlciBDQSAtIEc0AhAlsq27FC4B63Z8q1Jzxx+CMA0GCSqGSIb3DQEBAQUABIIB
AAdo77rragSoE03rhRS1INFONTTpQtj4XWq3Z1FuYB5RPvKwgJ2gzfS0wEsdRqm+qFDNHz1B
OAolSNlK7FmVKDoeUny5TClFLDq51nRK6Cf1vrwcu/xAUQ76YrbWLKkW8hYKQMOE5qlx8p1d
a8sVnFMEMQOqhABE3w1IebndonSQjp+pxQIbfMuyQE/x2JYApJHEdjj5A/7IjVsPzCKVE0by
11etZa8SV7Em+lHxw9Xz5EPGuCq00V83atrFx4/KplFYb7KfE3LRBfLVxjeUL8g/JmjBxF2t
O/p7UJwFNjqNT1NPnpEP4SSKpr+SMX4TQk7brULmwb3A4jQzbA6+gmwAAAAAAAA=
--------------ms020704060202070405060201--