X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=lSvEfnjlayLU41H0aSe2qMhH46WYLQSAxN3wGaRM/zGuMBZr/8V0M
	FrvpnLSE/am+OfmYBqylbdYpdyl5RSrPpcDWHe69RXo8dIQyYGIRPT7iq7ejXHJ2
	9OcBMIlqT7YZhc6WS/0c0VBbDhULGAx/DyU/7KuQY934caP+DiwfW8=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	 bh=dYQgU4NBrhRmInPyE1eGO+mQRHc=; b=vifwgNxYbSqk0X8R+lpTcSpY4N6k
	amrPdbXFCw83VRWaskcrXDY+61o8IHBFSmMLnbcXrcq9Y9rJnUDpEcrBT6NeZggX
	aanG80afOd+a1SidbLtmQkJY6a1XhU2esBtSTSpB2WgjZsvznzrFKV35LyoYuk7p
	GYaKyFE5idFCuM8=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-96.3 required=5.0 tests=AWL,BAYES_00,GOOD_FROM_CORINNA_CYGWIN,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_PBL,RCVD_IN_SORBS_DUL,RDNS_DYNAMIC autolearn=ham version=3.3.2 spammy=D*vinschen.de, Nothing, 20046, 18946
X-HELO: calimero.vinschen.de
Date: Wed, 29 Jun 2016 17:13:22 +0200
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: POSIX permission mapping and NULL SIDs
Message-ID: <20160629151322.GN981@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <D392F074.962E%billziss AT navimatics DOT com> <20160624215948 DOT GD27089 AT calimero DOT vinschen DOT de> <D39583E5.96E3%billziss AT navimatics DOT com> <1945820393 DOT 20160627122324 AT yandex DOT ru> <20160627102614 DOT GA8258 AT calimero DOT vinschen DOT de> <D396C16E.9770%billziss AT navimatics DOT com> <20160628102705 DOT GA22797 AT calimero DOT vinschen DOT de> <D3980824.9862%billziss AT navimatics DOT com> <20160629082129 DOT GC981 AT calimero DOT vinschen DOT de> <20160629134515 DOT GL981 AT calimero DOT vinschen DOT de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;	protocol="application/pgp-signature"; boundary="4eRLI4hEmsdu6Npr"
Content-Disposition: inline
In-Reply-To: <20160629134515.GL981@calimero.vinschen.de>
User-Agent: Mutt/1.6.1 (2016-04-27)

--4eRLI4hEmsdu6Npr
Content-Type: multipart/mixed; boundary="4VrXvz3cwkc87Wze"
Content-Disposition: inline


--4VrXvz3cwkc87Wze
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Jun 29 15:45, Corinna Vinschen wrote:
> Hi Bill,
>=20
> On Jun 29 10:21, Corinna Vinschen wrote:
> > On Jun 28 18:06, Bill Zissimopoulos wrote:
> > > In any case I will use your mapping of S-1-0-65534 <-> 65534.
> >=20
> > Thanks.  Do you want to add handling for this mapping to
> > pwdgrp::fetch_account_from_windows yourself or shall I do it?  I could
> > come up with a patch in the next couple of days.  I will prepare a
> > developer's snapshot then, so you can immediately test if it works as
> > desired.
>=20
> How do we avoid name collisions?  I can easily see admins creating an
> AD account called "nobody".
>=20
> Shall we fake a "WinFSP" domain such that the name is "WinFSP+nobody"?

Preliminary patch attached.


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--4VrXvz3cwkc87Wze
Content-Type: text/plain; charset=utf-8
Content-Disposition: attachment; filename="0001-Handle-WinFSP-nobody-account.patch"
Content-Transfer-Encoding: quoted-printable

=46rom a0bdba1cc4b8515e933e1c1caf59fcc310c48613 Mon Sep 17 00:00:00 2001
From: Corinna Vinschen <corinna AT vinschen DOT de>
Date: Wed, 29 Jun 2016 17:12:38 +0200
Subject: [PATCH] Handle WinFSP nobody account

Per discussion started at
https://cygwin.com/ml/cygwin/2016-06/msg00347.html

S-1-0-65534 =3D=3D WinFSP\nobody =3D=3D WinFSP+nobody =3D=3D uid/gid 65534
---
 winsup/cygwin/uinfo.cc | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/winsup/cygwin/uinfo.cc b/winsup/cygwin/uinfo.cc
index 247131d..af1a4e5 100644
--- a/winsup/cygwin/uinfo.cc
+++ b/winsup/cygwin/uinfo.cc
@@ -1894,6 +1894,14 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t=
 &arg, cyg_ldap *pldap)
 	}
       if (!ret)
 	{
+	  if (!strcmp (arg.name, "WinFSP+nobody"))
+	    {
+	      /* Special case "nobody" for reproducible construction of a
+		 nobody SID for WinFSP.  We use the value 65534 which is
+		 -2 with 16 bit uid/gids. */
+	      csid.create (0, 1, 0xfffe);
+	      break;
+	    }
 	  debug_printf ("LookupAccountNameW (%W), %E", name);
 	  return NULL;
 	}
@@ -2004,6 +2012,15 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t=
 &arg, cyg_ldap *pldap)
 	  sid =3D logon_sid;
 	  break;
 	}
+      else if (arg.id =3D=3D 0xfffe)
+	{
+	  /* Special case "nobody" for reproducible construction of a
+	     nobody SID for WinFSP.  We use the value 65534 which is
+	     -2 with 16 bit uid/gids. */
+	  csid.create (0, 1, 0xfffe);
+	  sid =3D csid;
+	  break;
+	}
       else if (arg.id < 0x10000)
 	{
 	  /* Nothing. */
@@ -2428,6 +2445,14 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t=
 &arg, cyg_ldap *pldap)
 	  return NULL;
 	}
     }=20
+  else if (sid_id_auth (sid) =3D=3D 0 && sid_sub_auth (sid, 0) =3D=3D 0xff=
fe)
+    {
+      uid =3D gid =3D 0xfffe;
+      wcpcpy (dom, L"WinFSP");
+      wcpcpy (name =3D namebuf, L"nobody");
+      fully_qualified_name =3D true;
+      acc_type =3D SidTypeUnknown;
+    }
   else if (sid_id_auth (sid) =3D=3D 5 /* SECURITY_NT_AUTHORITY */
 	   && sid_sub_auth (sid, 0) =3D=3D SECURITY_LOGON_IDS_RID)
     {
--=20
2.5.5


--4VrXvz3cwkc87Wze--

--4eRLI4hEmsdu6Npr
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXc+WSAAoJEPU2Bp2uRE+gnuwQAJ+tczRSTpcdREQwWxjx38D7
2iNuj4f5HYpyefNit4ECW2Lm//IcJlaG9vv4VCd2ELnf8S+eRdmjnPBruuDrn23k
x/DWall656ePiFCDbVjfLFUj0SuZuX8bTbKcC2vxNAAeVZbBcmcRTbdN+/VIU8+5
wOI4R2D1jrP4b2WBaE4vUmOl3h+N6CwuxUQkbCTr+ZM32HQzZxBb9+i8ZCEQpCV/
hwbogVz0vS9xR0a8oBGv5xcKpMo90+7pzuUPxelX3lRcLEhNFpi5y1WiG8L/nmxw
MLjCQuh5ycqOkMyQE0QYEv3NBEHg/6F32q3Ibz0Pg+UqTavrvdmQW+mkFaEWFHED
EkxZS+S5GlrKsavmhCM6Wsou4/L/nRk0pkujzMvNMyhFhTALyrtiB3hwDIUXIkSI
uEDf3ys9A54CowE4z3zm4vT0DRi1HAgwFibZb4EW8MCQASxVJgB3f3ljmBK/xmyw
iMUDSAdKIU2N/xEt9ZGKKmnVgqSVDnJUfRqDR7pJBXMPGHhirK20bTMb9O5MR4Y9
IgGy4dlYRZgGGs5LFOxs7PbzkheFsk2Fpo48nBvfnUH1cnmVOENdX4MCPcjWiNk+
BIK0VJk3lsKs/11RS+DFMFhQx/e6Pt+w6NPP5eFMIh6IhuLGuvttKaguYq0wVZz2
0vGbYqai2RDsDvqhSk8z
=trFt
-----END PGP SIGNATURE-----

--4eRLI4hEmsdu6Npr--