X-Recipient:	archive-cygwin AT delorie DOT com
DKIM-Filter:	OpenDKIM Filter v2.11.0 sourceware.org 02BF43857805
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1657180613;
	bh=LnH54LTN0TjNycfbEBSZ/8XDFEnNhZq0AmdUpRxxAgc=;
	h=Date:From:To:Subject:References:In-Reply-To:List-Id:
	List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe:
	Reply-To:From;
	b=l804V3+if8F3ZobVTAbfpo7eOUoaCJkaEjOoZNu7FdGtCKddy9VUE+Ud/FSE85kVY
	LIT7mqRJgwUlBmXw/y7j5xYSlXNWIKgc0ukdWDeZrls3QZpII4OwT+TlzpiNcWf19m
	Zz0jf8H8L2z4Ye5HbUPkHDtyDmDPCkQ6F4ACWTnY=
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.1 sourceware.org A74313858D32
Authentication-Results:	sourceware.org;
	dmarc=fail (p=none dis=none) header.from=cygwin.com
Authentication-Results:	sourceware.org; spf=fail smtp.mailfrom=cygwin.com
Date:	Thu, 7 Jul 2022 09:56:20 +0200
From:	Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To:	cygwin AT cygwin DOT com
Subject:	Re: The "TrustedInstaller" user can not be found by ID
Message-ID:	<YsaRpNwfLbBq+Qb+@calimero.vinschen.de>
Mail-Followup-To:	cygwin AT cygwin DOT com
References:	<1558196978 DOT 20220706133209 AT yandex DOT ru>
	<YsXHGlVpP4DeIWnW AT calimero DOT vinschen DOT de>
	<1282276604 DOT 20220706234513 AT yandex DOT ru>
MIME-Version:	1.0
In-Reply-To:	<1282276604.20220706234513@yandex.ru>
X-Provags-ID:	V03:K1:82B/DQTNoj9FOPUrPQEbbOmDaVMDtUCtaZ72Qwky2LoMB7nxC0+
	09olSh1cnbl/gF2kHaCkhDfAWyKRtIGOimAtYzTLotS4qplXj8A4M+Cjcjn3jdwcAIK0XgJ
	VZggZsYwwlnYv3F/dfUCbFF00/6+S1yN6VXHfl4tiCBCeE9Nl9N0RwXgukHySjH0W/GzEAf
	j+u96CTHqB7olyRo8zVwg==
X-UI-Out-Filterresults:	notjunk:1;V03:K0:xZrKlYXYDGI=:KUKtavQ2Kc7WfeAgAZR5ML
	tGuehaxtkqq6//kemZigZN7ZzA9T1ZhSX8ukC6SUeOfUK6I4us+hI9tgie20IvGoJZJ6yZ9nS
	F1m2d6DyKcszwjewmbSDQ/ZwtcxTs6SI5Mkt3GU1wABdGhM3tdaV/BamQhp/XSp4vFZmP4Etg
	smP4wCLLoanp8sTH5VOcoa2bdawnLWiVhOpcpxIV9xtd7Lobqaz5aTACLBYS/INnjhOgrGZf7
	egEVRvw/kp6j3hbDldfhIWfEAdwWvNCxGL6y/ANLzeg1mYljwAxrDfkJbeiuWqTQwh2WxtSsk
	cj+q/2sfvoye/lVp7xkIu8XB7jw42dUmNvYiSXTGOG/88VfSN9NSAiEKLXoan3isfw6fZ1o+I
	wlqe97YVd7Bewl8rR/mCwX+FDc2K9+VZwK/UIo+LXhnpqvMpqhWXSPH6Z7hyYfe5HND1wGeSe
	uocORsn8jKZlkZhu0bGEJL68+bKwsJyjTqT4frNkqpPOB3YKjmcMiEkZDlTeL2hbCjJdOmwgH
	e4se2wweBQiKdSpIFeLPBNi8ae0mtWIu1aXDPOvT188i1LEXSI4P8GnKBIwDyPOVjVNR+84I/
	VMjPyEQBIMaaT5smzGIt4fQXO8ZKt5SKcH4MmtBW/0mBwkieyWeljIMmMIoty9/h7lioE9bMW
	sYwS7MN+9orcE1IjioPmY6sptyYh10Y0HelLWWXFudSlugNHdMJNdG0UJD8rqXAowJnzgCRTl
	9nf/yHOQgiOXSKlPRcxpUrIUJp8gXPif/Rd2SCIO87uyU6HDedWL6SF5Kyo=
X-Spam-Status:	No, score=-93.6 required=5.0 tests=BAYES_00, BODY_8BITS,
	GOOD_FROM_CORINNA_CYGWIN, KAM_DMARC_NONE, KAM_DMARC_STATUS, RCVD_IN_MSPIKE_H2,
	SPF_FAIL, SPF_HELO_NONE, TXREP,
	T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version:	SpamAssassin 3.4.6 (2021-04-09) on
	server2.sourceware.org
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.29
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe:	<https://cygwin.com/mailman/options/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
Reply-To:	cygwin AT cygwin DOT com
Errors-To:	cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com
Sender:	"Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>
X-MIME-Autoconverted:	from base64 to 8bit by delorie.com id 2677utYZ009100

On Jul  6 23:45, Andrey Repin wrote:
> Greetings, Corinna Vinschen!
> 
> > On Jul  6 13:32, Andrey Repin wrote:
> >> Greetings, All!
> >> 
> >> Been doing some housekeeping in my Cygwin installation at work, and wanted to
> >> change the owner of the files to something other than myself.
> >> TrustedInstaller seemed like a good neutral target, but it took me a little
> >> while to find out it is
> >> 
> >> 1. …named "NT SERVICE+TrustedInstaller" actually (which is predictable
> >> somewhat);
> >> $ getent passwd | grep -i trust
> >> NT SERVICE+TrustedInstaller:*:328384:328384:U-NT SERVICE\TrustedInstaller,S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464:/:/sbin/nologin
> >>
> >> 2. …can not be accessed by any other name (unlike "NT AUTHORITY\SYSTEM");
> >> $ getent passwd System
> >> system:*:18:18:U-NT AUTHORITY\system,S-1-5-18:/home/system:/bin/bash
> >> $ getent passwd 18
> >> система:*:18:18:U-NT AUTHORITY\система,S-1-5-18:/home/система:/bin/bash
> 
> > This is by design.  Only builtin stuff and the primary domain members
> > can be accessed name-only.  "NT SERVICE" is not builtin, but rather a
> > kind of foreign domain identifier (but don't take this literally), so
> > you have to use the full name "NT SERVICE+TrustedInstaller".  Note
> > that this is a restriction in the Windows function LookupAccountName,
> > as documented in the source:
> 
> > https://sourceware.org/git/?p=newlib-cygwin.git;a=blob;f=winsup/cygwin/uinfo.cc;hb=HEAD#l2032
> 
> That explains it, thank you.
> 
> >> 3. …can not be accessed by ID! Which is rather surprising.
> >> $ getent passwd 328384
> >> [2] <- user not found
> >> 
> >> Is this some special case of some kind of Windows' kinks?
> 
> > This is impossible with the current code.  Cygwin tries to perform
> > bijective SID<->id mappings, if possible.  "NT SERVICE" accounts are a
> > bit of a problem and TrustedInstaller is no exception in that the SIDs
> > don't follow the usual rules for BUILTIN / NT AUTHORITY / normal
> > accounts.  They are also not exactly predictable, even though
> > TrustedInstaller always has the same SID on all systems. To handle
> > 328384 as TrustedInstaller, it needs actual special casing.  We can add
> > that, but that would only allow the explicit mapping between "NT
> > SERVICE+TrustedInstaller" and uid/gid 328384.  This would not cover
> > other NT SERVICE accounts.
> 
> I was thinking cygserver could level such troubles.
> Since name resolution coming through it more or less, it could maintain the
> mappings of uid => SID of the accounts it had seen, and respond correctly if
> `db_enum` contains "cache".

Caching is just caching, not an entirely different algorithm.  When you
use cygserver, it just asks the Cygwin DLL on behalf of another process.
The caching itself actually occurs inside the Cygwin DLL and is always
present, even without cygserver:
https://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-mapping-caching

Having said that, in my case, starting tcsh via mintty with no cygserver
running, I can request the info just fine:

$ getent passwd 328384
NT SERVICE+TrustedInstaller:*:328384:328384:U-NT SERVICE\TrustedInstaller,S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464:/:/sbin/nologin

If I start tcsh inside a Windows console, the above command fails, so I
guess mintty already requests the info under some circumstances so I can
happily request the cached passwd entry.

Having said that, caching doesn't help, if the info hasn't been
requested before.  You always need at least one request for "NT
SERVICE+TrustedInstaller" inside your process tree to allow a
subsequent successful reverse mapping.

Caching is nice and all, but fact is, that I can't get the info from the
OS, and that's the actual problem.

> > Given that TrustedInstaller is only used by the OS at installation time,
> > I always looked at it as a kind of "read-only account".  I'm really not
> > sure if it's worth special casing this account just to allow id->SID
> > mapping...


Corinna

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

- Raw text -