X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=G8DlWBEt3rRLNCKRb65P4SZCnQ+Fn8M3QGi3Z33zHt+igofj9kCkN
	1P2pQGIxjv0/zW8FRvNChegtHk12xCKKo5dALvV9DvOujXEEH79Ft7YS+dni6AV4
	Q/HjQUJwdPhTuO09jR58/AC2FKK6ixh/EYBlSvMcs4oIzMcHX2rBNs=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	 bh=y9dlnyG5LsWUuuNQRNUU67XhsRY=; b=kjc9Y8KIdg2w2AYuWW6pSVhS6rjE
	XdTyrjpz6CeYImb9F2J/GFWl0qFz3crnL2+/uUpbYDtQcQ5TFVXO/BghKZWo6uCz
	rFVF74U5hGXctds/DF9HTcegSHgmLx3OgLhv0ad/wCv88/ot9pnV5H9KTCOWMBNz
	ceignLp5HTYwpXk=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-5.9 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.3.2
X-HELO: calimero.vinschen.de
Date: Wed, 12 Mar 2014 10:16:49 +0100
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: Testers needed:  New passwd/group handling in Cygwin
Message-ID: <20140312091649.GD8066@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <20140310191603 DOT GH28681 AT calimero DOT vinschen DOT de> <87iorlsvvn DOT fsf AT Rainer DOT invalid> <loom DOT 20140311T081705-682 AT post DOT gmane DOT org> <20140311102007 DOT GJ28681 AT calimero DOT vinschen DOT de> <loom DOT 20140311T125212-440 AT post DOT gmane DOT org> <20140311130716 DOT GB21306 AT calimero DOT vinschen DOT de> <loom DOT 20140311T152430-775 AT post DOT gmane DOT org> <20140311154750 DOT GP28681 AT calimero DOT vinschen DOT de> <loom DOT 20140311T172511-742 AT post DOT gmane DOT org> <loom DOT 20140311T180753-745 AT post DOT gmane DOT org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;	protocol="application/pgp-signature"; boundary="/e2eDi0V/xtL+Mc8"
Content-Disposition: inline
In-Reply-To: <loom.20140311T180753-745@post.gmane.org>
User-Agent: Mutt/1.5.21 (2010-09-15)

--/e2eDi0V/xtL+Mc8
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mar 11 17:12, Achim Gratz wrote:
> Achim Gratz <Stromeko <at> NexGo.DE> writes:
> > Exactly.  But as revealed above, what was really missing is the
> > Administrators group.  Somehow, when "files" is in effect, that mapping
> > doesn't seem to exist unless it is explicitly listed in the file.  It d=
oes
> > get auto-created when I use _only_ the "db".  I hope that somehow makes
> sense...
>=20
> I guess it does: the mapping that gets created from AD is sometimes 10491=
20
> instead of 544.  That depends on the settings in nsswitch.conf and whether
> an /etc/group file exists at all or contains an entry for Administrators.

Argh!  What about *details* which allow to reproduce this behaviour.

In my environment I *never* see the admins group being produced with
a GID of 1049120.  And it doesn't make any sense at all.  The UID/GID
values starting with 0x100000 are reserved for accounts of the primary
domain.  The admins account is *never* an account of the primary domain
because its SID doesn't start with S-1-5-21-YOUR-DOMAIN-SID.  Rather
it's a builtin account with SID 1-5-32-544, which always gets converted
to UID/GID 544.

[...time passes...]

Hmm.  The only reason I can see which would allow to generate the GID
1049120 is, if your account has a primaryGroupID of 544 in AD, but that
*should* be impossible.  The AD user properties dialog doesn't allow to
set the primary group to a builtin group... unless you set this in the
attribute editor.  This is totally unexpected by Cygwin.  From AD it
just gets a RID value, and it simply adds this to the primary domain
offset 0x100000.

Ok, so, here's the question.  Is your primaryGroupID in AD 544?  If not,
you will have to explain to me how this happens.  I have found no other
way to reproduce this.


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--/e2eDi0V/xtL+Mc8
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJTICYBAAoJEPU2Bp2uRE+galQQAIMnVXIknaUxzcn3LLxlLAzb
4UcyW3cyBr/YU3dFKptiyji0Aauj7qz6pMIvYJSHF46mhBNz0f1k4Ev6Ffvch09L
HaI7GjE0fVzELBF6B3iAkjOs7B1G+Z8gbjfTygtMa8URS8pcEun4YkHJtjNxIT+j
MHui4NeyT7TOx19amjdUCkjnRAHykf/a4TMraRq/69PNRVfpeS4mQXJ0zKzo1Clr
HhnX3xs4iDMoie+SkEm2caAdafQZm0lYhOKrB4zpAGaRdjgBZkx988Dkmxw2+0F8
dhs4RK5YlVxfBFmXujmHxPcU8eCd75GfC5MfIMAwh6agLN6xZpuBgfhKi3hJjoYp
5olv2szmjVCKKoV5+h5MhGkUWE+TWc+llIFqTmT80m0uDY3bMVUd7Rsei6XxglY4
0yJyVi/K/F0AQ/50eOMQt/dS729i9JrXAZBO3w+pi0kJ22i1NPJVzpzQG5sN60u2
iq6ZQwrDde2uIb0sg00jgbcWJHEgFoDiWCQGQRhBByqhhJaahhZs4DSO6GTei7iJ
bTgGa7Z2cfrdkill5KYfCGclhGrPR/V0OgkNtEVodCX6Yz45IMNmHzWJBZWs+orJ
M4QmucZ/Lyl95/WZHcd6s5inFjxGAy2W3f+U2abmCteW89eOooRzINNWeTl2dBV2
FJ3A91NULX4dnl5SIuQn
=N+E4
-----END PGP SIGNATURE-----

--/e2eDi0V/xtL+Mc8--