X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:in-reply-to
	:references:mime-version:content-type:content-transfer-encoding;
	 q=dns; s=default; b=xQa/QyxdxQCztWOxC8PLSjjm/zpaGULeI9R5naYcGaR
	NZbxKRmgEK09f+WBxvlQrvpFAWxrvVJhj38OU297c/xvHf4d3nka1rBFazfuixtX
	m/8kcqZR1AezkjOZVc+laGHe52b96HcsbYV0QJZIynIrWr/3VP7IrUaW0c2teFLY
	=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:in-reply-to
	:references:mime-version:content-type:content-transfer-encoding;
	 s=default; bh=cQwAX5+bCEoUIAPYUnyWFbp4tnI=; b=bJQBg3GBjT0Afpn5l
	n57Ip6+uGuN6IWfKtmQ1Hx+71KrAYED8LPwZzrs+tVN8Igf13AdaFRjeZL+O14Gr
	LDqXe6/VaaU+jQKcA3yXintlXFgXIDRvJHN6z/7AskmpC7ldzWYYwhq10IXm4b0e
	988THuYgFoVu5UjZqoO3bu1xDw=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-1.0 required=5.0 tests=AWL,BAYES_00,SPF_PASS autolearn=ham version=3.3.2
X-HELO: conuserg007-v.nifty.com
X-Nifty-SrcIP: [116.80.65.201]
Date: Fri, 11 Sep 2015 21:33:46 +0900
From: Takashi Yano <takashi DOT yano AT nifty DOT ne DOT jp>
To: cygwin AT cygwin DOT com
Subject: Re: Group Permissions on root folders problem (Windows 10 TP build 10061)
Message-Id: <20150911213346.669fe6bed769b79a4afea225@nifty.ne.jp>
In-Reply-To: <20150911111012.GF26699@calimero.vinschen.de>
References: <CAMH9mcFEL3mao+m-DEYM84kC1HOPeSBpZXD+mDf0USobF9oY7g AT mail DOT gmail DOT com>	<CAMH9mcFOKjvjiFvvk1ju0ZxBDK28MaktdnYwj5_CjvbgnpVO4A AT mail DOT gmail DOT com>	<20150616155843 DOT GE31537 AT calimero DOT vinschen DOT de>	<20150905155916 DOT 8403bea8d4f631c1f7a314e3 AT nifty DOT ne DOT jp>	<20150906114444 DOT GA27066 AT calimero DOT vinschen DOT de>	<20150911190414 DOT e77404dc09587954644ab65d AT nifty DOT ne DOT jp>	<20150911111012 DOT GF26699 AT calimero DOT vinschen DOT de>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes

Hi Corinna,

On Fri, 11 Sep 2015 13:10:12 +0200
Corinna Vinschen wrote:
> In theory, yes.  The problem is just that checking the uid/gid equality
> is not safe, given that you can easily create that via passwd/group
> files.  What I was thinking of is to convert the uid/gid values into
> SIDs using the `getent' tool and to compare those, along the lines of
> 
>   uid=$(/usr/bin/stat -c '%u')
>   user_sid=$(getent passwd -w $uid | awk -F: '{print $4}')
>   gid=$(/usr/bin/stat -c '%g')
>   grp_sid=$(getent group -w $gid | awk -F: '{print $4}')
>   if [ "${user_sid}" = "${grp_sid}" ]
>     ...
> 
> Can you check if that works in your env and perhaps create a new patch
> using the SIDs?

I have made a new patch and confirmed that it also works.


--- cygwin-service-installation-helper.sh.orig	2015-02-24 04:57:56.000000000 +0900
+++ cygwin-service-installation-helper.sh	2015-09-11 21:30:08.539361900 +0900
@@ -2442,6 +2442,12 @@
 # ======================================================================
 _csih_setup()
 {
+  local uid
+  local gid
+  local user_sid
+  local grp_sid
+  local perms="d..x..x..[xt]"
+
   csih_stacktrace "${@}"
   $_csih_trace
   if [ "$_csih_setup_already_called" -eq 0 ]
@@ -2462,7 +2468,17 @@
       csih_error "Problem with LocalSystem or Adminstrator IDs"
     fi
 
-    if ! csih_check_dir_perms "${LOCALSTATEDIR}" "d..x..x..[xt]"
+    uid=$(/usr/bin/stat -c '%u' ${LOCALSTATEDIR})
+    gid=$(/usr/bin/stat -c '%g' ${LOCALSTATEDIR})
+    user_sid=$(/usr/bin/getent -w passwd $uid | awk -F: '{print $4}')
+    grp_sid=$(/usr/bin/getent -w group $gid | awk -F: '{print $4}')
+
+    if [ "${user_sid}" = "${grp_sid}" ]
+    then
+      perms="d..x.....[xt]"
+    fi
+
+    if ! csih_check_dir_perms "${LOCALSTATEDIR}" "${perms}"
     then
       csih_error "Problem with ${LOCALSTATEDIR} directory. Exiting."
     fi



-- 
Takashi Yano <takashi DOT yano AT nifty DOT ne DOT jp>

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple