X-Recipient:	archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status:	No, hits=0.1 required=5.0 tests=AWL,BAYES_50,RCVD_IN_DNSWL_NONE,T_RP_MATCHES_RCVD,UNPARSEABLE_RELAY
X-Spam-Check-By:	sourceware.org
Message-ID:	<4DB73858.8070401@t-online.de>
Date:	Tue, 26 Apr 2011 23:25:44 +0200
From:	Christian Franke <Christian DOT Franke AT t-online DOT de>
User-Agent:	Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.17) Gecko/20110123 SeaMonkey/2.0.12
MIME-Version:	1.0
To:	cygwin AT cygwin DOT com
Subject:	Re: [PATCH] base-files-4.0.6: Change prompt if running with admin rights
References:	<4D964392 DOT 6080809 AT t-online DOT de> <4DB45230 DOT 4080106 AT t-online DOT de> <4DB49339 DOT 9030909 AT gmail DOT com>
In-Reply-To:	<4DB49339.9030909@gmail.com>
X-IsSubscribed:	yes
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com

Daniel Colascione wrote:
> On 4/24/11 9:39 AM, Christian Franke wrote:
>    
>> On 2011-04-01, Christian Franke wrote:
>>      
>>> The attached patch for /etc/profile and /etc/bash.bashrc sets a root
>>> prompt ('#' instead of '$' or '%') if the shell runs with admin rights
>>> (local or domain admin group).
>>>
>>>        
>> Any comment so far? Wrong list ?
>>      
>
> I like the idea, but your patch adds two subprocess invocations to the
> shell startup path. Each one takes ~200ms, and we can't afford to add
> any more.
>
>    

Agree.


> Instead of examining the group list, you can use something like
>
> local isadmin=0
> [[ -w / ]]&&  isadmin=1
>
>    

False positive if same user installed Cygwin by running setup.exe with 
admin rights.

[[...]] does not work with posh and dash. But all shells apparently have 
a builtin '[' command.


> or
>
> local isadmin=0
> [[ -w /cygdrive/c ]]&&  isadmin=1
>
>    

False positive if /cygdrive is mounted with 'noacl' option.


> Of course, that test assumes that only "administrators" can write to the
> drive root, and that's an imperfect proxy for administrative rights. You
> get the idea though: try to perform the test in pure bash code.
>
>    

Using a read access test on a registry key with SYSTEM only access might 
work in most cases:

[ -r /proc/registry/HKEY_LOCAL_MACHINE/SECURITY ] && isadmin=1

Test succeeds if SeBackupPrivilege is enabled which is the case for 
Cygwin processes if user is in admin group or another group with this 
privilege.

A test script for all shells is attached. Run with admin rights. 
Requires cygdrop from cygutils package.

Script produces a false negative only from dash. Not really an issue, as 
dash is normally not used interactively.

Christian


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -