X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:mime-version
	:content-type:content-transfer-encoding; q=dns; s=default; b=jYb
	WSAC/VSyO9rebC8PvjruIJ+f18lr+ud0ax/RO4NyLS0oIAKAqlpjQNbe6sYo1APH
	ZHgpaCbFvszGTdpq+jvdDKJSWd0rEUvHRXGECWvftBYjfDigX5XeObaJLaeKE48G
	bVSBz0r4MMIzYfS0yTQglCkOKOG460Tmho4I+FPw=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:mime-version
	:content-type:content-transfer-encoding; s=default; bh=NxV+9asM4
	dhVyvn9zl8t3CCjRas=; b=TzuE7/h4uNdBLfC3741U0HjDt6RGUENtEbOjeI4UG
	CQ2lMLGoG4x9k5YMnLCPrLCWL/ReERh+ojtK/3I19bdbT0fCVfKbx5yzhfl4dUdB
	p9k7DvnAJTnRWV9VaQlrFk0Y6jBnwj1Uh0A9Ke2sHTmpvt7zB7bZKNf7V055DLFL
	nk=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Spam-SWARE-Status:	No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.2 spammy=elevated, Login, freeze, screen
X-HELO:	conssluserg-06.nifty.com
DKIM-Filter:	OpenDKIM Filter v2.10.3 conssluserg-06.nifty.com x26FxrD5006695
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=nifty.ne.jp; s=dec2015msa; t=1551887993; bh=LAGYE6lRidx6zhi5ELg7riGudyNT9UHG8OMDHN0WiTk=; h=Date:From:To:Subject:From; b=Pi1BJK4m0M1oqo3zZlq9QXktbCjyVOHFRXhMrHd8V9S8R3HXo9q2TwWxPj/kiAZvB +wNYb51rH6apAII4p2rTqx30W5Dt1oEuNLcGkOV4ToGtD4Lr5Jd8K9RbfrEDj/9GYq 9G1+a2xfTC4AxXVbapboJh1UB/xNndmWnapqFU5u7YIQTKxlGxP2obl5G/BW3jGqrZ 3xwR2+/SEOenvEJx5FRa+U/t5YIz7DlHC5iO7GPB78Y8q+FiuIAGB0QQb3SXb1GudR vQzsWqjXjXahhP/lc1rmNaAeq40IzibQfTEgDsSL7h72o+I9iQZLiNm8oByR50Q3Ym R8jxJc+kfwnxw==
Date:	Thu, 7 Mar 2019 01:00:00 +0900
From:	Takashi Yano <takashi DOT yano AT nifty DOT ne DOT jp>
To:	cygwin AT cygwin DOT com
Subject:	Logging-in using ssh elevates the user privilege.
Message-Id:	<20190307010000.fc28b73739c2dd66e609982b@nifty.ne.jp>
Mime-Version:	1.0
X-IsSubscribed:	yes

Hello,

I would like to report a problem of recent cygwin.

If a user logs in via ssh, the user aqcuires the elevated
privilege if the user belongs to Administrators group.

The following log is the example of the behaviour.

[yano AT Express5800-S70 ~]$ touch /cygdrive/c/windows/testfile
touch: cannot touch '/cygdrive/c/windows/testfile': Permission denied
[yano AT Express5800-S70 ~]$ ssh localhost
yano AT localhost's password:
Last login: Thu Mar  7 00:06:21 2019 from ::1
CYGWIN_NT-10.0-WOW Express5800-S70 3.0.2(0.338/5/3) 2019-03-05 19:01 i686 Cygwin
[yano AT Express5800-S70 ~]$ touch /cygdrive/c/windows/testfile
[yano AT Express5800-S70 ~]$ rm /cygdrive/c/windows/testfile
[yano AT Express5800-S70 ~]$ exit
logout
Connection to localhost closed.
[yano AT Express5800-S70 ~]$

Because of this behaviour, the process started in a ssh
session cannot be killed from a normal mintty session.

This also causes gnu screen to freeze.

To reproduce this:
(1) Start screen in mintty window.
(2) Detatch from the screen (Ctrl-A d).
(3) Login via ssh.
(4) Attach screen by 'screen -r' in ssh session.
(5) Detach from the screen (Ctrl-A d).
(6) screen freezes and is not terminated normally.

This does not occur if the user does not belong to
Administrators group.

I guess this is a problem of setuid codes.

-- 
Takashi Yano <takashi DOT yano AT nifty DOT ne DOT jp>

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -