DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:mime-version
	:content-type:content-transfer-encoding; q=dns; s=default; b=jYb
	WSAC/VSyO9rebC8PvjruIJ+f18lr+ud0ax/RO4NyLS0oIAKAqlpjQNbe6sYo1APH
	ZHgpaCbFvszGTdpq+jvdDKJSWd0rEUvHRXGECWvftBYjfDigX5XeObaJLaeKE48G
	bVSBz0r4MMIzYfS0yTQglCkOKOG460Tmho4I+FPw=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Date: Thu, 7 Mar 2019 01:00:00 +0900
From: Takashi Yano <takashi DOT yano AT nifty DOT ne DOT jp>
To: cygwin AT cygwin DOT com
Subject: Logging-in using ssh elevates the user privilege.
Message-Id: <20190307010000.fc28b73739c2dd66e609982b@nifty.ne.jp>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Hello,

I would like to report a problem of recent cygwin.

If a user logs in via ssh, the user aqcuires the elevated
privilege if the user belongs to Administrators group.

The following log is the example of the behaviour.

[yano AT Express5800-S70 ~]$ touch /cygdrive/c/windows/testfile
touch: cannot touch '/cygdrive/c/windows/testfile': Permission denied
[yano AT Express5800-S70 ~]$ ssh localhost
yano AT localhost's password:
Last login: Thu Mar  7 00:06:21 2019 from ::1
CYGWIN_NT-10.0-WOW Express5800-S70 3.0.2(0.338/5/3) 2019-03-05 19:01 i686 Cygwin
[yano AT Express5800-S70 ~]$ touch /cygdrive/c/windows/testfile
[yano AT Express5800-S70 ~]$ rm /cygdrive/c/windows/testfile
[yano AT Express5800-S70 ~]$ exit
logout
Connection to localhost closed.
[yano AT Express5800-S70 ~]$

Because of this behaviour, the process started in a ssh
session cannot be killed from a normal mintty session.

This also causes gnu screen to freeze.

To reproduce this:
(1) Start screen in mintty window.
(2) Detatch from the screen (Ctrl-A d).
(3) Login via ssh.
(4) Attach screen by 'screen -r' in ssh session.
(5) Detach from the screen (Ctrl-A d).
(6) screen freezes and is not terminated normally.

This does not occur if the user does not belong to
Administrators group.

I guess this is a problem of setuid codes.

-- 
Takashi Yano <takashi DOT yano AT nifty DOT ne DOT jp>

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple