X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=P2ho5EQ+HImsCWtDyG/gU/GflOVzcD8ynddmYHxUCoJq/SNJKjvpr
	9oflPyrfKjOvYZ+D1y45IgAcpMJ1vxzu1w+cW2VZTaw5Ex6qEpUz6/NnbukB6idZ
	kM5PBVW/9tdfgcJWhnXgdyeCMERUjNd/r6oEt/iuQbzBr6E/G/EBUE=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	 bh=HZHNOml5WXT6xwcC5gj3kEyMVkQ=; b=IGKB3dLF/Wa61K+EhkuJbC5j6EJM
	QSo+tGAzro4GGjGBwMcMpx1XholFriswpKqjrzfXlVKNNV+e5gH/Tk7UhKFV4dRz
	Ke+AmoxkV41HpTT5BCr1CUJpOwoeEcSuSBhO8Xnpcsbu7gbJBCDUN9qKSHUvYGkN
	8EONMtvLPoGbmp4=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-4.7 required=5.0 tests=AWL,BAYES_05,KAM_LAZY_DOMAIN_SECURITY autolearn=no version=3.3.2
X-HELO: calimero.vinschen.de
Date: Fri, 11 Sep 2015 17:18:20 +0200
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: Group Permissions on root folders problem (Windows 10 TP build 10061)
Message-ID: <20150911151820.GH26699@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <CAMH9mcFEL3mao+m-DEYM84kC1HOPeSBpZXD+mDf0USobF9oY7g AT mail DOT gmail DOT com> <CAMH9mcFOKjvjiFvvk1ju0ZxBDK28MaktdnYwj5_CjvbgnpVO4A AT mail DOT gmail DOT com> <20150616155843 DOT GE31537 AT calimero DOT vinschen DOT de> <20150905155916 DOT 8403bea8d4f631c1f7a314e3 AT nifty DOT ne DOT jp> <20150906114444 DOT GA27066 AT calimero DOT vinschen DOT de> <20150911190414 DOT e77404dc09587954644ab65d AT nifty DOT ne DOT jp> <20150911111012 DOT GF26699 AT calimero DOT vinschen DOT de> <20150911213346 DOT 669fe6bed769b79a4afea225 AT nifty DOT ne DOT jp>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;	protocol="application/pgp-signature"; boundary="hAW+M2+FUO+onfmf"
Content-Disposition: inline
In-Reply-To: <20150911213346.669fe6bed769b79a4afea225@nifty.ne.jp>
User-Agent: Mutt/1.5.23 (2014-03-12)

--hAW+M2+FUO+onfmf
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sep 11 21:33, Takashi Yano wrote:
> Hi Corinna,
>=20
> On Fri, 11 Sep 2015 13:10:12 +0200
> Corinna Vinschen wrote:
> > In theory, yes.  The problem is just that checking the uid/gid equality
> > is not safe, given that you can easily create that via passwd/group
> > files.  What I was thinking of is to convert the uid/gid values into
> > SIDs using the `getent' tool and to compare those, along the lines of
> >=20
> >   uid=3D$(/usr/bin/stat -c '%u')
> >   user_sid=3D$(getent passwd -w $uid | awk -F: '{print $4}')
> >   gid=3D$(/usr/bin/stat -c '%g')
> >   grp_sid=3D$(getent group -w $gid | awk -F: '{print $4}')
> >   if [ "${user_sid}" =3D "${grp_sid}" ]
> >     ...
> >=20
> > Can you check if that works in your env and perhaps create a new patch
> > using the SIDs?
>=20
> I have made a new patch and confirmed that it also works.
>=20
>=20
> --- cygwin-service-installation-helper.sh.orig	2015-02-24 04:57:56.000000=
000 +0900
> +++ cygwin-service-installation-helper.sh	2015-09-11 21:30:08.539361900 +=
0900
> @@ -2442,6 +2442,12 @@
>  # =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>  _csih_setup()
>  {
> +  local uid
> +  local gid
> +  local user_sid
> +  local grp_sid
> +  local perms=3D"d..x..x..[xt]"
> +
>    csih_stacktrace "${@}"
>    $_csih_trace
>    if [ "$_csih_setup_already_called" -eq 0 ]
> @@ -2462,7 +2468,17 @@
>        csih_error "Problem with LocalSystem or Adminstrator IDs"
>      fi
>=20=20
> -    if ! csih_check_dir_perms "${LOCALSTATEDIR}" "d..x..x..[xt]"
> +    uid=3D$(/usr/bin/stat -c '%u' ${LOCALSTATEDIR})
> +    gid=3D$(/usr/bin/stat -c '%g' ${LOCALSTATEDIR})
> +    user_sid=3D$(/usr/bin/getent -w passwd $uid | awk -F: '{print $4}')
> +    grp_sid=3D$(/usr/bin/getent -w group $gid | awk -F: '{print $4}')
> +
> +    if [ "${user_sid}" =3D "${grp_sid}" ]
> +    then
> +      perms=3D"d..x.....[xt]"
> +    fi
> +
> +    if ! csih_check_dir_perms "${LOCALSTATEDIR}" "${perms}"
>      then
>        csih_error "Problem with ${LOCALSTATEDIR} directory. Exiting."
>      fi

Thank you, patch applied.


Heading into vacation now.


Have fun,
Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--hAW+M2+FUO+onfmf
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJV8vC8AAoJEPU2Bp2uRE+gbkMQAJi8zR1Jsutz5StN6pINzLxO
+WJ6RlNSFEW+JwslfhOibOGr+29XDySRR/f3FCnmajY/yV5Udwgjb2kqs+OXLDve
++M0qlABlFS4ZqqrHkudQ9NMekiD6p1wIOUrYERcWHIgWjPz5JAmIMfGXFMOnmMI
Ylgfqs2UeSc92cT8Tu8yOvUQsJqbJLuvlAn+BhVKxDR+9Tc62pmHxyBL9twIFADb
rYfIyYK3Ek+Tembccnk2TBSFVSsRzZHKDJ3wN/u7tvngtoo/iIW7i+OOI/0BjLZ4
g40MKvNOptJQ/GFjkHWI5CgSowTLihKvqeGQdGbZvwUi0K1DbMNnjFVcpXy+qzrI
+acoJgcH6Yhd/8z+PUHDERXHufmTP2ngtxTnkrG7iFG+RWOLd131hkNPfDZy7Lt6
WpbloDGupS29sBSGeSHl3Gd6u7V7qgO4QLG2+WGbyNJYx8zwphBcLJoLWsuprpDR
/1/YEIwBSPjmkO66xYn2Zi2klC/IaGwyWU/CbZy1v3zUBn+1lhMzAYHMrWMkxbkM
Dd+smTSLzL8T02D6EvJoINV9qq9Z6vhgL3d3eZa72fMAywn+aAQWqZc5LcRd/t04
dnvSglgMAc2LlswhNnI49/UcBLLrP0tlayGFdzj3VMvLvB4Hw268ukEbeJBdIszf
l+x27MT7CURfAolTR646
=lW6c
-----END PGP SIGNATURE-----

--hAW+M2+FUO+onfmf--