DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:from:date:message-id:subject:to
	:content-type; q=dns; s=default; b=KNt0wsc35FUOd9EK4BAupWEll8Tls
	ayZmsaeOHvv6VPwxRlz89qmxhsoL+Wzj/VM06EhaPgjM05PBZV8xgfQy6G+s0OYp
	Q5fj0Nb/gZjTcFyoPe2jPpN3R6tfyu9DmwUE/nB1NOd10Iq3w0jyH5e2QwbGotN5
	0M76L/HmuA4Zys=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
From: Sam Habiel <sam.habiel@gmail.com>
Date: Wed, 6 Jun 2018 09:20:49 -0400
Message-ID: <CABHT961S4_s8A=eBJNUKOU3vGMh_D_s_ACUqaFbswsgmMzq7cg@mail.gmail.com>
Subject: Help with sgid into the Administrators group (or alternatives?)
To: cygwin@cygwin.com
Content-Type: text/plain; charset="UTF-8"

I am continuing to port GT.M to Cygwin
(https://www.fisglobal.com/solutions/banking-and-wealth/services/database-engine).

The database has a suid program that is marked u+s (root suid) on the
file permissions so that it can run as root whenever invoked. One of
the first things it does is cd to another directory that is owned by
root and is not accessible by anybody else.

Cygwin doesn't have the concept of root; so I am trying to implement
this by sgid into the Adminstrators group (544) from a limited user
account (i.e., set-up that way on Windows). The executable, instead of
being suid root, is sgid Adminstrators. The sgid C call apparently
succeeds when I run it from gdb, but the C chdir instruction fails.

I read https://cygwin.com/cygwin-ug-net/ntsec.html; but haven't done
anything it says. After all, the sgid call apparently succeeded.

My question is: am I on the right path; or is Windows and Cygwin being
reasonable in denying my request to chdir when the user is not a
member of the Administrators group, in spite of the executable being
sgid Administrators?

--Sam

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple