I'm using secaudit built from 2011.4.12AR6 to set ACLs and file attributes on files copied to a new filesystem mounted with ntfs-3g on linux. The ACLs are being applied, but the attributes (eg. hidden/archive/system/etc) are not taking effect when Windows boots. If I remount the filesystem under linux and use 'getattr -h -e hex -n system.ntfs_attrib_be', the attributes appear to be set, but Windows doesn't see them. If I use 'setattr -h -v 0x00000027 -n system.ntfs_attrib_be <filename>' and then reboot into windows, the attributes are set correctly. I know secaudit used to set the attributes properly (yes, I'm using '-e' on the command line). I'm not sure which version stopped working, but it seems to have worked in one of the 2010 releases.

Has anyone else seen this behavior?

It turns out that it does still work... sort of. I had recently added some setting of reparse data and 8.3 filenames in my code, and that was being done before running secaudit to apply the ACLs and attributes. If I run secaudit before setting the reparse points and 8.3 filenames, the attributes take effect in Windows. Weird...

Hi,


This is a bug, the attributes were not properly set. Good catch.

Good point, setting the file name restores the integrity of attributes.

Attached is a patch.

Thanks for reporting

Regards

Jean-Pierre

Thanks!