X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type; q=dns; s=default; b=vtHDSR
	CXKl64dWQQFrHk2pX3dXhz3ZQZjhUw8L/MgNDjjR0fmnN8Xn9d3US1eHxc5WQ6PX
	Rox94UQgv4GS+cTjO7zVtyrerGG04/pInkgwlSwFNCN+25hpxjvwehLw4tPjxLE1
	Lxl/5maE7Gcurhn4TAkurzTxHiW6Y9rHKyccU=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type; s=default; bh=vXXl5dcXsqN6
	fvExoC5Kz+Eosig=; b=wWKAT+TYJmIDi9SNurwz/iKF30omT4q7zVDN3JY3CsgJ
	UjYCjiEVNAjlqtBcQa+ekg0pSkxu+vaYWr5rambw7Bdutiw2/5UC20UWsfYk4iKg
	W2wzGNX/ipiXR0UIU/7EKDZ/7qqnNywAHGqlJz7eToB4iHfsdL0hkF0+d67TiXw=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Virus-Found:	No
X-Spam-SWARE-Status:	No, score=-0.6 required=5.0 tests=AWL,BAYES_50 autolearn=ham version=3.3.2
X-HELO:	mail.secure-endpoints.com
X-MDAV-Result:	clean
X-MDAV-Processed:	mail.secure-endpoints.com, Thu, 24 Jul 2014 18:18:40 -0400
VBR-Info:	md=secure-endpoints.com; mc=all; mv=vbr.emailcertification.org;
X-Spam-Processed:	mail.secure-endpoints.com, Thu, 24 Jul 2014 18:18:39 -0400 (not processed: message from trusted or authenticated source)
X-HashCash:	1:22:140724:md50000694664::/U7O6PhrOJfX/ERO:00009V+2
X-Return-Path:	prvs=128237bc4f=jaltman AT secure-endpoints DOT com
X-Envelope-From:	jaltman AT secure-endpoints DOT com
X-MDaemon-Deliver-To:	cygwin AT cygwin DOT com
Message-ID:	<53D1863B.8090304@secure-endpoints.com>
Date:	Thu, 24 Jul 2014 18:18:35 -0400
From:	Jeffrey Altman <jaltman AT secure-endpoints DOT com>
User-Agent:	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.0
MIME-Version:	1.0
To:	cygwin AT cygwin DOT com
Subject:	Re: The eternal uid issue
References:	<53CF6CEC DOT 6D68E485 AT boland DOT nl> <20140723091409 DOT GH27005 AT calimero DOT vinschen DOT de> <53CF9E0F DOT F596FC60 AT boland DOT nl> <20140723152357 DOT GA24446 AT calimero DOT vinschen DOT de> <53D0AD3A DOT 1FDF0B3F AT boland DOT nl> <20140724135222 DOT GD12212 AT calimero DOT vinschen DOT de> <53D17DCD DOT 726524E0 AT boland DOT nl>
In-Reply-To:	<53D17DCD.726524E0@boland.nl>
OpenPGP:	id=92B69A04; url=http://pgp.mit.edu

--------------ms060702020606090507080706
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 7/24/2014 5:42 PM, D. Boland wrote:
> Hi Corinna,
>=20
> Corinna Vinschen wrote:
>> But be careful.  Just because there are multiple users with admin
>> permissions, that doesn't mean they all want their mail in the same
>> mailbox for user 0...

Things are actually worse than Corinna and others have described.  The
SYSTEM account is a built-in local machine account that by default is
granted certain permissions but those permissions are configurable.

There is a built-in Administrator account which everyone is taught to
never use

There are two default groups "Administrators" and "Domain
Administrators" whose members are considered to be administrators but
whose logon sessions run in a restricted mode which is tighter in many
regards than standard users UNLESS the process running as that user is
granted "elevated" access.

Simply working off the user's SID or GIDs to make decisions are often
going to result in failures that appear to your users as unpredictable.

> Thanks for the overloading code. I already tested it. Now I can leave the=
 Sendmail
> code (almost) unchanged. Thanks also for the time you put into this. I ho=
pe the
> RedHat people pay you well.
>=20
> I have Sendmail ready to be released, but only the 'crude' version (runni=
ng as an
> admin user). I'd like to go for the preferred solution (starting as admin=
, switching
> to unprivileged). The uid issue is sorted. But to get it there, I have on=
e final
> problem to solve.

On all modern versions of Windows the accounts that are members of the
Administrators and Domain Administrators accounts are going to run
unprivileged.

In the Windows world background daemons (aka services) should be
assigned their own service account that is granted the minimum set of
privileges required.   Windows permissions are much more fine grained
than POSIX and this gives you a great deal of control.

Shedding privileges can be done by a privileged process by replacing its
process (or thread access tokens) with a more restricted version.

> Sendmail checks if the user's home directories are group- or world writab=
le. It does
> this with 'stat'. If Sendmail is running in 'crude' mode (main program an=
d children
> running as the Sendmail 'smmsp' user, made admin), stat returns the right=
 file mode
> for my home directory (rwxr-xr-x). The email is delivered.

On Windows file systems (as with many UNIX network file systems, think
AFS as one example) the UNIX mode is not going to have much value.
What matters are the entries in the access control list and that is what
should be checked and manipulated.   Cygwin can't turn a non-POSIX file
system into a POSIX file system no matter how hard it tries.

> If I have Sendmail running in preferred mode (main program as cyg_server,=
 children
> running as 'smmsp', removed from admin group), stat returns the wrong mode
> (rwxrwxrwx). As a consequence, Sendmail refuses to deliver email.

The UNIX mode cannot describe the fine grained permissions of the access
control language for the file system.

> Can I do anything about this?

Other members of this group might have some additional suggestions on
how to remove checks but if you really want secure delivery of e-mail on
a Windows file system you will need to write code that is capable of
understanding the capabilities of the file system.  Just as you would on
UNIX if the home directory was in a network file system that relied upon
GSS/Kerberos network credentials and Access Control Lists instead of
UNIX mode for access control.

Jeffrey Altman



--------------ms060702020606090507080706
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEH
AQAAoIINITCCBkIwggUqoAMCAQICEDirAC//rpa3Vv85Wvtd5xswDQYJKoZI
hvcNAQEFBQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwg
SW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UE
CxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1
c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMSBQdWJsaWMgUHJp
bWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczMB4XDTExMDkwMTAw
MDAwMFoXDTIxMDgzMTIzNTk1OVowgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQK
ExRTeW1hbnRlYyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1
c3QgTmV0d29yazEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcw
NQYDVQQDEy5TeW1hbnRlYyBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJl
ciBDQSAtIEc0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxuwn
/R1j9DsdisHTHMjIgoa2uEqGkqqBXHLKMA0vnkEiVzAhJZCao/SsKsaIF4Zh
chN2LuwDyyebjyCAN+DkitpVplAP/LlcI2mJQqG6H6/vDvmkyQrx+DeyxtmS
Sq5937hEH5u6P4wG/tgjT0hRI2pghKjuJy9g35byGiqMPI8AzE/L+iCOvDX2
4fCatgXz/B0/xhR7DtryBeTTgwKmxWlwtKnkVunbHVz0pjbia7UeKi3cvrvu
OgSwMAitX2hsxr0GloiE5+apZC28ODC7iCbDZ2ZmtLR3+cChxw5y72bi5bnK
4POFdzWY3tQcsP5mceI4y258T0BV65fZqBge7QIDAQABo4ICRDCCAkAwOAYI
KwYBBQUHAQEELDAqMCgGCCsGAQUFBzABhhxodHRwOi8vcGtpLW9jc3AudmVy
aXNpZ24uY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAwbAYDVR0gBGUwYzBhBgtg
hkgBhvhFAQcXATBSMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LnN5bWF1dGgu
Y29tL2NwczAoBggrBgEFBQcCAjAcGhpodHRwOi8vd3d3LnN5bWF1dGguY29t
L3JwYTA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnZlcmlzaWduLmNv
bS9wY2ExLWczLmNybDAOBgNVHQ8BAf8EBAMCAQYwKQYDVR0RBCIwIKQeMBwx
GjAYBgNVBAMTEVZlcmlTaWduTVBLSS0yLTk3MB0GA1UdDgQWBBSt+cOTci21
uShh5KTXYNXECl4aATCB8QYDVR0jBIHpMIHmoYHQpIHNMIHKMQswCQYDVQQG
EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT
aWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWdu
LCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZl
cmlTaWduIENsYXNzIDEgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBB
dXRob3JpdHkgLSBHM4IRAItbdVaEVIULAM+vOEjOsaQwDQYJKoZIhvcNAQEF
BQADggEBANaPwdqbiPKzbE0fWC+6AVFddMFG6MO4e5/WQPHv/zK6iWvADjRD
n6SZ5qTwXUgzYoWFYf4jiCKMYJsrnGVJlMSiOCRIpVylUEto6WIip5PomSJu
PVu7EEIOH0x1RzRWCY/4vYw881y70pZwVHBiTe/REL6dSCxe7IZrB4LwPeEl
Jygs4BZ2HrP95WKW0oo9Xyuu+1zCE7dlY8s0dkOf1oeZq26tlcEAP0Yngf81
3iMOQ9wUXzL5yinvwlIw9ZnduYH4OiUgjYJo8rkhhXRmBOGGORYy8i3WKqjJ
3tkAAk/jGCDFpYFWtpXe04Kt+HslvmR8LqC6cCz4+XXidE0HbYQwggbXMIIF
v6ADAgECAhA5oFEXaG88XscBgkTPSsu4MA0GCSqGSIb3DQEBBQUAMIGmMQsw
CQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAd
BgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsTFVBlcnNv
bmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJ
bmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHNDAeFw0xMzEyMjMwMDAwMDBa
Fw0xNTAxMTYyMzU5NTlaMIHOMS4wLAYDVQQDDCVQZXJzb25hIE5vdCBWYWxp
ZGF0ZWQgLSAxMzU4Mjc1NTk5Njg2MSswKQYJKoZIhvcNAQkBFhxqYWx0bWFu
QHNlY3VyZS1lbmRwb2ludHMuY29tMQ8wDQYDVQQLDAZTL01JTUUxHjAcBgNV
BAsMFVBlcnNvbmEgTm90IFZhbGlkYXRlZDEfMB0GA1UECwwWU3ltYW50ZWMg
VHJ1c3QgTmV0d29yazEdMBsGA1UECgwUU3ltYW50ZWMgQ29ycG9yYXRpb24w
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCtcVgrUA+Zl527P0yx
xfkiLZzymUZLAwif9amX6c79OHd17CN5Hg3TIRXi0exjq/z/K2eftbSfj3Xa
tgllPtlmCktqi4daJTVLifx5G7qbcYjQgKpex/8FA3gfvJJNgMef5OwOTE1H
qMJsp5CAquFjw/ReiXQqduou1nHhUhX1AXBpaQmYDOQZwrTD41yT7qm22N67
vV0viWG9x/1RdFqqtIOIyKR+ojD3IN0wufESgy7hsWgmghh4jkrclmMIXuo+
AAtmJHzwzF4hCrSqdwiRXU4aghTjsmehtMT1nFfzDPylaclOp7IY4xeQm/q1
cbU3uEqxhy06sYeVbh6zfTDBAgMBAAGjggLVMIIC0TAMBgNVHRMBAf8EAjAA
MA4GA1UdDwEB/wQEAwIFoDAgBgNVHSUBAf8EFjAUBggrBgEFBQcDBAYIKwYB
BQUHAwIwHQYDVR0OBBYEFLNBzIZb/xB6K+oeDwfBVLaB3qbUMCcGA1UdEQQg
MB6BHGphbHRtYW5Ac2VjdXJlLWVuZHBvaW50cy5jb20wHwYDVR0jBBgwFoAU
rfnDk3IttbkoYeSk12DVxApeGgEwggErBggrBgEFBQcBAQSCAR0wggEZMIIB
FQYIKwYBBQUHMAKGggEHbGRhcDovL2RpcmVjdG9yeS52ZXJpc2lnbi5jb20v
Q04lMjAlM0QlMjBTeW1hbnRlYyUyMENsYXNzJTIwMSUyMEluZGl2aWR1YWwl
MjBTdWJzY3JpYmVyJTIwQ0ElMjAtJTIwRzQlMkMlMjBPVSUyMCUzRCUyMFBl
cnNvbmElMjBOb3QlMjBWYWxpZGF0ZWQlMkMlMjBPVSUyMCUzRCUyMFN5bWFu
dGVjJTIwVHJ1c3QlMjBOZXR3b3JrJTJDJTIwTyUyMCUzRCUyMFN5bWFudGVj
JTIwQ29ycG9yYXRpb24lMkMlMjBDJTIwJTNEJTIwVVM/Y0FDZXJ0aWZpY2F0
ZTtiaW5hcnkwXQYDVR0fBFYwVDBSoFCgToZMaHR0cDovL3BraS1jcmwuc3lt
YXV0aC5jb20vY2FfNTYxYzEwMzY5MGM5N2E2OTI0N2EwZWYwNzFhYzgxYWYv
TGF0ZXN0Q1JMLmNybDBsBgNVHSAEZTBjMGEGC2CGSAGG+EUBBxcBMFIwJgYI
KwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vY3BzMCgGCCsGAQUF
BwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMCoGCmCGSAGG+EUB
EAMEHDAaBhFghkgBhvhFARABAgIEAYazFxYFMTA5MjIwDQYJKoZIhvcNAQEF
BQADggEBAACPkJV5NIxzjKc+WveaoM8Uc86wX0yLBm1A33z4rLVXTWPi5kMI
J6kfE+dFWcMdyyOgZ2VcxIwneZ50LcITFv1VOfRkrX32vVChQqs8XGqerIo/
K3epyFEg01qHq/4byolXW6UOvmZb3oHhtHDGS94Vv6Fu6wV7irAdoM18cqzQ
sxU0nZDMnY5k0pKJHLTrsC/uKuoWGz8xLLyeayi37ZsXsbGdazqzVMIoLvFT
MjaFuoCetEbiFQZvnuHKwdbVYqyCY28Cl8DVRHrInZrz84xqFiGZNSfFRWOo
ugT47VRDA8SVy6pOtDaOmkxcYXlh5Ezo29FBOiA0+tF8qgMmq3QxggRSMIIE
TgIBATCBuzCBpjELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENv
cnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMR4w
HAYDVQQLExVQZXJzb25hIE5vdCBWYWxpZGF0ZWQxNzA1BgNVBAMTLlN5bWFu
dGVjIENsYXNzIDEgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBIC0gRzQCEDmg
URdobzxexwGCRM9Ky7gwCQYFKw4DAhoFAKCCAmswGAYJKoZIhvcNAQkDMQsG
CSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTQwNzI0MjIxODM1WjAjBgkq
hkiG9w0BCQQxFgQUM0S/jYoCm8lMC4efDO9G6LsHUIIwbAYJKoZIhvcNAQkP
MV8wXTALBglghkgBZQMEASowCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4G
CCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG
9w0DAgIBKDCBzAYJKwYBBAGCNxAEMYG+MIG7MIGmMQswCQYDVQQGEwJVUzEd
MBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFu
dGVjIFRydXN0IE5ldHdvcmsxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlk
YXRlZDE3MDUGA1UEAxMuU3ltYW50ZWMgQ2xhc3MgMSBJbmRpdmlkdWFsIFN1
YnNjcmliZXIgQ0EgLSBHNAIQOaBRF2hvPF7HAYJEz0rLuDCBzgYLKoZIhvcN
AQkQAgsxgb6ggbswgaYxCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRl
YyBDb3Jwb3JhdGlvbjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29y
azEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFsaWRhdGVkMTcwNQYDVQQDEy5T
eW1hbnRlYyBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQSAtIEc0
AhA5oFEXaG88XscBgkTPSsu4MA0GCSqGSIb3DQEBAQUABIIBACJ+TWhGVqQ1
6AC2tzT/wTptuBdC4wMKsMAPouQn+BjEBn3doRQQ7OW1mh6PUkcRXco8XHrn
nEk28AMAHHou8ZtUqZqBSV+LQ0OWUhMpCcgoQ9y9JUBSodlNLXu49ip05EWY
rH298cPbsjEx647efDYtMP2WdKbhRHQ+gZfF6tAc3Q8Kj8FXMUASuIckkZsm
ytltYg1Cq5Fb6ZYoELmnxJ6E/aSwsshLlxV/PK1RYD9rMWvCnHXMCisKac4E
OgBXud4abnBfR5gHVfG+09tlZNf+hqi2SEATHaFFMjRH/TAdwJ+3UUs1v/m9
9huWZuIXBSbAGlqkV1Ou5sV0EMsy06kAAAAAAAA=

--------------ms060702020606090507080706--

- Raw text -