X-Recipient: archive-cygwin AT delorie DOT com
X-Spam-Check-By: sourceware.org
Message-ID: <488255B9.4020009@cwilson.fastmail.fm>
Date: Sat, 19 Jul 2008 16:59:37 -0400
From: Charles Wilson <cygwin AT cwilson DOT fastmail DOT fm>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.14) Gecko/20080421 Thunderbird/2.0.0.14 Mnenhy/0.7.5.666
MIME-Version: 1.0
To: cygwin AT cygwin DOT com
Subject: Re: CSIH patch (Re: Unable to run sshd under a domain sshd_server    account [SOLVED])
References: <3B3EFBD49B94AD4DBB7B7097257A8046DD020D AT FDSVAST06SXCH01 DOT flooddata DOT net> <Pine DOT GSO DOT 4 DOT 63 DOT 0805121820090 DOT 11953 AT access1 DOT cims DOT nyu DOT edu> <20080513073720 DOT GA22193 AT calimero DOT vinschen DOT de> <3B3EFBD49B94AD4DBB7B7097257A8046DD02FC AT FDSVAST06SXCH01 DOT flooddata DOT net> <20080616210105 DOT GI731 AT calimero DOT vinschen DOT de> <20080616211352 DOT GK731 AT calimero DOT vinschen DOT de> <48821B9F DOT 6070907 AT cwilson DOT fastmail DOT fm> <20080719171235 DOT GO5675 AT calimero DOT vinschen DOT de> <488252B5 DOT 8000501 AT cwilson DOT fastmail DOT fm>
In-Reply-To: <488252B5.8000501@cwilson.fastmail.fm>
Content-Type: multipart/mixed;  boundary="------------070404090100010709080308"
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

--------------070404090100010709080308
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Charles Wilson wrote:
> Corinna Vinschen wrote:
> 
>> However, I sent a second patch in
>> http://cygwin.com/ml/cygwin/2008-06/msg00453.html
>> The Interactive Logon Right is also necessary for this account.
> 
> I don't know why I missed that. I'll roll 0.1.6 soon.

Here's the followup patch I applied (with modified changedlog). I'll 
wait for additional comments concerning cyg_server et. al. appearing in 
/etc/passwd before rolling 0.1.6.

--
Chuck

	* cygwin-service-installation-helper.sh
	(csih_account_has_necessary_privileges): Don't explicitely
	test for SeDenyXXX rights, nor for SeIncreaseQuotaPrivilege.
         (csih_create_privileged_user): Drop setting
	SeDenyInteractiveLogonRight and SeIncreaseQuotaPrivilege.


--------------070404090100010709080308
Content-Type: text/plain;
 name="csih-rights-2.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="csih-rights-2.patch"

diff -u -b -r1.8 cygwin-service-installation-helper.sh
--- cygwin-service-installation-helper.sh	19 Jul 2008 16:40:31 -0000	1.8
+++ cygwin-service-installation-helper.sh	19 Jul 2008 20:53:31 -0000
@@ -1639,9 +1639,6 @@
           editrights -u "${user}" -t SeAssignPrimaryTokenPrivilege     >/dev/null 2>&1 &&
           editrights -u "${user}" -t SeCreateTokenPrivilege            >/dev/null 2>&1 &&
           editrights -u "${user}" -t SeTcbPrivilege                    >/dev/null 2>&1 &&
-          editrights -u "${user}" -t SeDenyInteractiveLogonRight       >/dev/null 2>&1 &&
-          editrights -u "${user}" -t SeDenyRemoteInteractiveLogonRight >/dev/null 2>&1 &&
-          editrights -u "${user}" -t SeIncreaseQuotaPrivilege          >/dev/null 2>&1 &&
           editrights -u "${user}" -t SeServiceLogonRight               >/dev/null 2>&1
           return # status of previous command-list
         fi
@@ -2104,9 +2101,7 @@
         editrights -a SeAssignPrimaryTokenPrivilege -u ${username} &&
         editrights -a SeCreateTokenPrivilege -u ${username} &&
         editrights -a SeTcbPrivilege -u ${username} &&
-        editrights -a SeDenyInteractiveLogonRight -u ${username} &&
         editrights -a SeDenyRemoteInteractiveLogonRight -u ${username} &&
-        editrights -a SeIncreaseQuotaPrivilege -u ${username} &&
         editrights -a SeServiceLogonRight -u ${username} &&
         username_got_all_rights="yes"
         if [ "${username_got_all_rights}" != "yes" ]


--------------070404090100010709080308
Content-Type: text/plain; charset=us-ascii

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/
--------------070404090100010709080308--