How to restrict cygwin's permissions in Windows 7

Question

After an... ahem... incident involving an ill-judged rm -rf, it occurred to me that if you have administrator permissions on your Windows machine, working within a Cygwin terminal is the equivalent of using a root shell in Unix.

This can have unfortunate consequences, such as... accidentally wiping your entire filesystem with an ill-judged rm -rf.

So, my question is: while logged in from a Windows account with administrator permissions, how can I limit cygwin's permissions, in a manner analogous to running under a user account instead of root on Unix systems?

What I would like is to have write permission to my own files in the folders where I do my work, but get "Permission denied" errors whenever I (accidentally) write things in places I shouldn't be touching such as /cygdrive/c/Windows.

I have googled "cygwin permissions" and similar keywords, but only found people wanting to get more permission than cygwin is giving them.

Theres an article here about Windows security in Cygwin, but I can't understand it, probably because I don't understand Windows access control well enough...

Answer 1

If you turn on User Account Control (UAC) — see http://msdn.microsoft.com/en-us/library/windows/desktop/aa511445.aspx for details — then when you login as a user who is a member of the local group Administrators, you will not have write access to files under C:\Windows, even from a Cygwin Bash shell. You should see this:

$ cd /cygdrive/c/windows
$ touch xyzzy
touch: cannot touch `xyzzy': Permission denied

I cannot even delete files under C:\Windows. For example, I opened a Command Prompt elevated to Administrator, changed directory to C:\Windows, and typed copy system.ini xyzzy.ini. Now I see this in a Cygwin Bash shell (not elevated):

$ cd /cygdrive/c/windows
$ icacls xyzzy.ini
xyzzy.ini NT AUTHORITY\SYSTEM:(I)(F)
          BUILTIN\Administrators:(I)(F)
          BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files
$ rm xyzzy.ini
rm: remove write-protected regular file `xyzzy.ini'? y
rm: cannot remove `xyzzy.ini': Permission denied
$ rm -f xyzzy.ini
rm: cannot remove `xyzzy.ini': Permission denied

So even though I am a member of local group Administrators, I cannot delete files under C:\Windows.