I wonder if there is a chance of Kopia using the win32 SeBackupPrivilege to bypass NTFS ACLs ?
It’s quite common for users to alter the permissions tab of files on shared network drives. Admin teams may want to restrict access to a folder, but they rarely consider making sure the Administrator user still has access. This can mean the user running kopia from the file server may not have access to those files and folder as well.
This is overcome in Robocopy with a ‘Backup Mode’ operation.
A description of this is copied from a superuser.com post below:
Backup mode is a way to read and write files ignoring any permissions problems.
It uses the
SeBackupPrivilege(reading) andSeRestorePrivilege(writing) in order to read/write any and all files, disregarding any ACEs that would prevent you from reading or writing a file.Normally when trying to copy or access a file, Windows performs a check to make sure you have permission to read or write to location, but with
SeBackupPrivilege(granted to the Backup Operators and Administrators groups by default), andSeRestorePrivilege(also granted to the Backup Operators and Administrators groups by default), these checks are bypassed.On domain controllers, the mentioned user rights are also available to the Server Operators group.
From the documentation for
SeBackupPrivilegeThis user right determines which users can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This user right is effective only when an application attempts access through the NTFS backup application programming interface (API) through a backup tool such as NTBACKUP.EXE. Otherwise, standard file and directory permissions apply.
This user right is similar to granting the following permissions to the user or group you have selected on all files and folders on the system:
- Traverse Folder/Execute File
- List Folder/Read Data
- Read Attributes
- Read Extended Attributes
- Read Permissions
From the documentation on
SeRestorePrivilege:This security setting determines which users can bypass file, directory, registry, and other persistent object permissions when they restore backed up files and directories, and it determines which users can set valid security principals as the owner of an object.
Granting this user right to an account is similar to granting the account the following permissions to all files and folders on the system:
- Traverse folder / execute file
- Write
To check if your account has these privileges, you can run the command
whoami /privat a command prompt.
