DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org EB4F53858D28
Subject: Re: Running bash script as SYSTEM from account with admin rights?
To: cygwin@cygwin.com
References: <CANH4o6M0id2F7VCyzFWzje-BUd2oRGhp07PRNLJnEyzkYTbhSA@mail.gmail.com>
 <b4f5c1be-8b8d-6abc-6c13-c86537f4af43@t-online.de>
 <CANH4o6P+x7VaB0W5kjxmd_4DOHi8GDuRmfyZfE3dNJ4YixTfzQ@mail.gmail.com>
Message-ID: <80d1ad82-efce-79e7-5e49-f884f50035f6@t-online.de>
Date: Fri, 22 Sep 2023 14:39:08 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 SeaMonkey/2.53.16
MIME-Version: 1.0
In-Reply-To: <CANH4o6P+x7VaB0W5kjxmd_4DOHi8GDuRmfyZfE3dNJ4YixTfzQ@mail.gmail.com>
Precedence: list
From: Christian Franke via Cygwin <cygwin@cygwin.com>
Reply-To: Christian Franke <Christian.Franke@t-online.de>
Content-Type: text/plain; charset="utf-8"; Format="flowed"
Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>
Content-Transfer-Encoding: 8bit

Martin Wege via Cygwin wrote:
> On Fri, Sep 22, 2023 at 9:42 AM Christian Franke via Cygwin
> <cygwin@cygwin.com> wrote:
>> Martin Wege via Cygwin wrote:
>>> Hello,
>>>
>>> Does Cygwin have a tool to run a bash script as SYSTEM user if my
>>> account already have admin rights?
>> No (AFAIK).
>>
>> I use psexec from Sysinternals tools
>> (https://learn.microsoft.com/sysinternals/downloads/psexec)
>>
>> This starts a Cygwin terminal as SYSTEM user:
>>
>> psexec -s -i c:\cygwin\bin\mintty -
> Use of psexec is forbidden, as it triggers our security software (Cortex XDR).

Then it is possibly not recommended to do anything special that psexec 
could do, except if there exists an explicit permission :-)


> Windows has https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-impersonateloggedonuser
> Can we use that to write a C wrapper program, to switch from current
> user with admin rights to the SYSTEM account, execute command and then
> exit(0) the wrapper?

Function from this API are also used by the setuid() emulation of Cygwin 
(https://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-setuid-overview). 
User switching relies on an access token returned by LogonUser() or 
similar. This requires a password or other credential which is (AFAIK) 
never available for the SYSTEM user.

Windows services are run as SYSTEM by default. Running the script with 
bash installed as a service (via cygrunsrv) may do the trick.

-- 
Regards,
Christian


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple