X-Recipient: archive-cygwin@delorie.com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=G8DlWBEt3rRLNCKRb65P4SZCnQ+Fn8M3QGi3Z33zHt+igofj9kCkN
	1P2pQGIxjv0/zW8FRvNChegtHk12xCKKo5dALvV9DvOujXEEH79Ft7YS+dni6AV4
	Q/HjQUJwdPhTuO09jR58/AC2FKK6ixh/EYBlSvMcs4oIzMcHX2rBNs=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	 bh=y9dlnyG5LsWUuuNQRNUU67XhsRY=; b=kjc9Y8KIdg2w2AYuWW6pSVhS6rjE
	XdTyrjpz6CeYImb9F2J/GFWl0qFz3crnL2+/uUpbYDtQcQ5TFVXO/BghKZWo6uCz
	rFVF74U5hGXctds/DF9HTcegSHgmLx3OgLhv0ad/wCv88/ot9pnV5H9KTCOWMBNz
	ceignLp5HTYwpXk=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe@cygwin.com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin@cygwin.com>
List-Help: <mailto:cygwin-help@cygwin.com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Delivered-To: mailing list cygwin@cygwin.com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-5.9 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.3.2
X-HELO: calimero.vinschen.de
Date: Wed, 12 Mar 2014 10:16:49 +0100
From: Corinna Vinschen <corinna-cygwin@cygwin.com>
To: cygwin@cygwin.com
Subject: Re: Testers needed:  New passwd/group handling in Cygwin
Message-ID: <20140312091649.GD8066@calimero.vinschen.de>
Reply-To: cygwin@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
References: <20140310191603.GH28681@calimero.vinschen.de> <87iorlsvvn.fsf@Rainer.invalid> <loom.20140311T081705-682@post.gmane.org> <20140311102007.GJ28681@calimero.vinschen.de> <loom.20140311T125212-440@post.gmane.org> <20140311130716.GB21306@calimero.vinschen.de> <loom.20140311T152430-775@post.gmane.org> <20140311154750.GP28681@calimero.vinschen.de> <loom.20140311T172511-742@post.gmane.org> <loom.20140311T180753-745@post.gmane.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;	protocol="application/pgp-signature"; boundary="/e2eDi0V/xtL+Mc8"
Content-Disposition: inline
In-Reply-To: <loom.20140311T180753-745@post.gmane.org>
User-Agent: Mutt/1.5.21 (2010-09-15)

--/e2eDi0V/xtL+Mc8
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mar 11 17:12, Achim Gratz wrote:
> Achim Gratz <Stromeko <at> NexGo.DE> writes:
> > Exactly.  But as revealed above, what was really missing is the
> > Administrators group.  Somehow, when "files" is in effect, that mapping
> > doesn't seem to exist unless it is explicitly listed in the file.  It d=
oes
> > get auto-created when I use _only_ the "db".  I hope that somehow makes
> sense...
>=20
> I guess it does: the mapping that gets created from AD is sometimes 10491=
20
> instead of 544.  That depends on the settings in nsswitch.conf and whether
> an /etc/group file exists at all or contains an entry for Administrators.

Argh!  What about *details* which allow to reproduce this behaviour.

In my environment I *never* see the admins group being produced with
a GID of 1049120.  And it doesn't make any sense at all.  The UID/GID
values starting with 0x100000 are reserved for accounts of the primary
domain.  The admins account is *never* an account of the primary domain
because its SID doesn't start with S-1-5-21-YOUR-DOMAIN-SID.  Rather
it's a builtin account with SID 1-5-32-544, which always gets converted
to UID/GID 544.

[...time passes...]

Hmm.  The only reason I can see which would allow to generate the GID
1049120 is, if your account has a primaryGroupID of 544 in AD, but that
*should* be impossible.  The AD user properties dialog doesn't allow to
set the primary group to a builtin group... unless you set this in the
attribute editor.  This is totally unexpected by Cygwin.  From AD it
just gets a RID value, and it simply adds this to the primary domain
offset 0x100000.

Ok, so, here's the question.  Is your primaryGroupID in AD 544?  If not,
you will have to explain to me how this happens.  I have found no other
way to reproduce this.


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--/e2eDi0V/xtL+Mc8
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJTICYBAAoJEPU2Bp2uRE+galQQAIMnVXIknaUxzcn3LLxlLAzb
4UcyW3cyBr/YU3dFKptiyji0Aauj7qz6pMIvYJSHF46mhBNz0f1k4Ev6Ffvch09L
HaI7GjE0fVzELBF6B3iAkjOs7B1G+Z8gbjfTygtMa8URS8pcEun4YkHJtjNxIT+j
MHui4NeyT7TOx19amjdUCkjnRAHykf/a4TMraRq/69PNRVfpeS4mQXJ0zKzo1Clr
HhnX3xs4iDMoie+SkEm2caAdafQZm0lYhOKrB4zpAGaRdjgBZkx988Dkmxw2+0F8
dhs4RK5YlVxfBFmXujmHxPcU8eCd75GfC5MfIMAwh6agLN6xZpuBgfhKi3hJjoYp
5olv2szmjVCKKoV5+h5MhGkUWE+TWc+llIFqTmT80m0uDY3bMVUd7Rsei6XxglY4
0yJyVi/K/F0AQ/50eOMQt/dS729i9JrXAZBO3w+pi0kJ22i1NPJVzpzQG5sN60u2
iq6ZQwrDde2uIb0sg00jgbcWJHEgFoDiWCQGQRhBByqhhJaahhZs4DSO6GTei7iJ
bTgGa7Z2cfrdkill5KYfCGclhGrPR/V0OgkNtEVodCX6Yz45IMNmHzWJBZWs+orJ
M4QmucZ/Lyl95/WZHcd6s5inFjxGAy2W3f+U2abmCteW89eOooRzINNWeTl2dBV2
FJ3A91NULX4dnl5SIuQn
=N+E4
-----END PGP SIGNATURE-----

--/e2eDi0V/xtL+Mc8--