X-Spam-Check-By: sourceware.org
Message-ID: <43BDFFA8.A3A8250@dessent.net>
Date: Thu, 05 Jan 2006 21:27:04 -0800
From: Brian Dessent <brian@dessent.net>
MIME-Version: 1.0
To: cygwin@cygwin.com
Subject: Re: 'su' no longer working?
References: <Pine.GSO.4.63.0601051732360.5388@slinky.cs.nyu.edu> <43BDF429.5050206@byu.net> <dpktus$nom$1@sea.gmane.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes
Reply-To: cygwin@cygwin.com
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe@cygwin.com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin@cygwin.com>
List-Help: <mailto:cygwin-help@cygwin.com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Delivered-To: mailing list cygwin@cygwin.com

Joe Smith wrote:

> For passworded user switching:
> SE_ASSIGNPRIMARYTOKEN_NAME &&
> SE_INCREASE_QUOTA_NAME &&
> SE_TCB_NAME

for pr in AssignPrimaryToken IncreaseQuota Tcb; do 
    editrights -a Se${pr}Privilege -u user
done

> For passwordless user switching:
> SE_CREATE_TOKEN_NAME &&
> SE_ASSIGNPRIMARYTOKEN_NAME &&
> SE_INCREASE_QUOTA_NAME

for pr in CreateToken AssignPrimaryToken IncreaseQuota; do 
    editrights -a Se${pr}Privilege -u user
done

> You should not cripple to program to being usable only on the system
> account.
> It is very much possible to give a user those privleges, and easy on XP pro
> via the group policy editor (according to microsoft. I've never tried it.)

It was for this very reason (command-line automated privilege
manipulation) that editrights was written and placed in the 'base'
Cygwin install so that *-config scripts can use it for creating services
that run as non-SYSTEM accounts.

Brian


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/