CM not allowing me to save to virtual drive

[Blue_Sky]

I’ve always been able to download/save files directly to my vault folders, but now get a popup saying “you don’t have permission to save to this folder” and to contact the administrator - which is me!. It also happens if I download the file first to Downloads, and then try and save it to a vault folder (see attachment). When I click on the folder in my vault and go into Properties>Security, instead of showing my name, it has something like S-1-0-##### (maybe this is normal). Didn’t have these issues until I took the latest update with Winfsp.

I can still unlock the encrypted vault, see the contents (folders/files) and access the files - the problem seems to be centered on saving files to a folder. It won;t even allow me to create a copy of a file within the same folder (see attachment)

Running Windows 11
Virtual Drive volume type is set to Automatic

Anbody have a solution?

I may have stumbled on the solution. I selected WebDav (Windows Explorer) as the volume type and restarted CM. Now appears to be letting me save files to and within vaults. Would still like to know if this is the correct solution.

[Michael]

should not make a difference. In fact WebDAV is not the recommended Volume type. Mostly seen as a backup solution if no other Volumen type is available.
Actually I cannot say why you have permission problems when using WinFSP.
I assume you start cryptomator with the same user you use to copy files in your vault?

[Blue_Sky]

I am the only user on my laptop if that’s what you mean, and windows recognizes me as the only user at logon. All I can say is when I experimented and changed to WebDAV (Windows Explorer) I was able to save files to vault folders again with no messages.

Just to experiment, I just changed it back to WinFsp (Local drive), closed and restarted CM, and again, I get the popup “cannot save - no permission” message again. Switched it back to WebDAV - and I can once again save/copy+save files to and within my vault folders. Go figure…

What would be your recommendation instead?

Would it be better to uninstall CM and reinstall? If I do that what happens to my existing vaults?

[Michael]

@Blue_Sky

Would it be better to uninstall CM and reinstall? If I do that what happens to my existing vaults?

It’s worth a try.
Your vault will not be deleted. You can add it against with the „add vault“ button.

Don’t forget that you have to uninstall winfsp manually. It will be installed again with cryptomator.

[infeo]

There seems to be a permission problem.

WinFsp tries to determine the permission automatically. For an affected vault, do you use custom mount flags?

If so, ensure, that -oid=-1 and -ogid=-1 are present.

Also check your WinFsp version: If your WinFsp version is too old, certain GUIds are not supported (see https://github.com/winfsp/winfsp/issues/387). If you are using the most recent version of WinFsp, this problem is resolved.

Also helpful might be the a comment in the above linked issue, how WinFsp deals now with such GUIDs:

[…] solves this problem by mapping ALL S-1-12-1- SID’s in the system to UID 0x1000 and GID 0x1001 (see commit cygwin/cygwin@eb61113). However it is possible to have multiple Azure AD accounts active in a particular system, which means that they would all be mapped to the same UID/GID, which obviously causes problems.
Instead I propose the following: FUSE acquires a new option that allows to specify a mapping of ANY UID(s) to ANY SID(s) or username(s). For example: -o uidmap=1000000:S-1-12-1-3430994482-1138470567-3993656486-3163079249 would map UID 1000000 to SID S-1-12-1-3430994482-1138470567-3993656486-3163079249 and -o uidmap=1000000:DOMAIN+USER would map UID 1000000 to user DOMAIN\USER.

You might have to use then custom mount flags with a custom mapping.

[Blue_Sky]

so CM seems to be back to normal after deleting the Winfsp 2022.2 file I manually installed…HOWEVER…when I open Virtual Drive options now, the volume type only shows three, Automatic and the two WebDAV’s. I have Automatic selected and it lets me save to folders and corrected the permissions issue, BUT… I was expecting to see the two Winfsp options…where did they go? Do I need to do something to re-enable them. I suspect I’m at a disadvantage because it seems WinFsp is the preferred mounting option from what I read.

[Michael]

@Blue_Sky

BUT… I was expecting to see the two Winfsp options…where did they go? Do I need to do something to re-enable them.

WinFSP needs to be installed to show these options. Please check in your windows installed programs if WinFSP is shown. If not please install.

If WinFSP is not shown in cryptomator then cryptomator uses an other volume type. In your case WebDAV.

[Blue_Sky]

@infeo

-oid=-1 and -ogid=-1 are present.

The custom mount flags -oid=-1and-ogid=-1 are visible, but the box is not checked by default (I don’t check boxes unless I know what it does which I don’t or am advised by an expert to do so).

Winfsp version: 2022.2

I installed Winfsp, reinstalled CM, all went well. I saw Winfsp as a volume type. All seems ok so I select Winfsp and restart CM. But when I open a vault and attempt to save a file (or make a copy and save that file) to a vault, I get the “no permission” popups again. Same issue as originally stated.

So… I deleted Winfsp (CM reverts back to Auto and WebDAV volume type options only - Winfsp options disappear as expected), BUT, I can then save files to vaults without any permission issue.

So whats broken here? And bottom lime me…if this can’t be resolved, isn’t CM still be able to do everything it’s designed to do anyway?

[infeo]

@infeo

However it is possible to have multiple Azure AD accounts active in a particular system, which means that they would all be mapped to the same UID/GID, which obviously causes problems.

Does this condition apply to your system? If so, unfortunately, you have to use custom mountoptions.

1. Find out your domain and user name with the whoami command in the terminal. For example:

C:\Users\User>whoami
myDomainName\myUserName

2. Define a custom mapping for uid in the custom mount options with the output:

-ouid=10 -gid=11 -ouidmap=10:MYDOMAINNAME+MYUSERNAME

[Blue_Sky]

I got:

C:\Users\will->whoami
matebook\william

so I should enter:

-ouid=10 -gid=11 -ouidmap=10:matebook+william

Is this correct?

[Blue_Sky]

So here’s something interesting. I changed my Windows account from using my Microsoft account credentials to a Local Account, and it now Winfsp volume type is working again (I can save files to vault folders , and also create copies of files within those same folders, which was my original issue).

Does this explain anything?

[infeo]

@Blue_Sky

Does this explain anything?

This points at least in a known direction. On Windows, you can sign in with different accounts. Local accounts or accounts coming from AzureAD (maybe even more). The latter ones caused problems in the past.

When you open the Windows cmd and enter

wmic useraccount where name='%username%' get sid`

does the output start with S-1-12-1-... ?