From: "Pierre A. Humblet" <Pierre.Humblet@ieee.org>
To: <cygwin-apps@cygwin.com>
Subject: RE: HEADSUP: New getent tool to read passwd and group data
Date: Fri, 21 Feb 2014 21:21:00 -0000 [thread overview]
Message-ID: <02cb01cf2f4a$cbc90cf0$635b26d0$@ieee.org> (raw)
In-Reply-To: <20140221202745.GE2246@calimero.vinschen.de>
> From: Corinna Vinschen
> Sent: Friday, February 21, 2014 15:28
> On Feb 21 12:47, Pierre A. Humblet wrote:
> > > From: cygwin-apps-owner[...]
> > > On Behalf Of Corinna Vinschen
> > > Sent: Thursday, February 20, 2014 14:38
> > > To: cygwin-apps[...]
> > >
> > > Hi guys,
> > >
> > >
> > > I just uploaded the new getent package and sent the announcement,
> > >
> > > I'm repeating myself here because this is really important and I'm
> > > not sure everybody on this list reads the cygwin and cygwin-announce
> lists.
> > >
> > > In short, we want to get rid of the requirement to maintain
> > > /etc/passwd and /etc/group files, per
> > > http://cygwin.com/ml/cygwin/2014-02/msg00306.html
> > >
> > > In future, tools and scripts, especially service installation helper
> > > scripts like my ssh-host-config, must not rely on being able to grep
> > > user and group information from /etc/passwd and /etc/group.
> > >
> > > Rather, the scripts should be changed to use the getent tool as soon
> > > as possible. Usage for checking passwd:
> > >
> > > $ getent passwd <username...>
> > >
> > > I'd like to ask all maintainers providing such scripts, including
> > > myself, to look into their packages and fix them to use the getent tool.
> > >
> >
> > Corinna,
> >
> > For packages such as exim we need to find the uid of System and of
> Administrator, which the user can set any which way in passwd.
> > So we lookup the SID (not the username) to get the uid (or gid).
>
> The SID of the administrator or the SID of the administrors group?
> The SID of the local administrator makes only marginal sense to me.
> What do you need it for?
I mean the administrators group.
It's needed for example to set the ownership of the configuration file.
The daemon checks that the file is owned/writable only by privileged users.
Similarly in cron the crontab files need to be readable by admins. cronbug checks for that
> > Is there an equivalent mechanism using getent ?
> > Else, could Cygwin disregard the passwd entries for these 2 users and use
> only the fixed values determined by the mapping from Windows?
>
> You should not have to expect a name change for the SYSTEM and the
> Administrators account. It should be entirely sufficient to check for the user
> Administrator and the user SYSTEM or +SYSTEM.
Is that independent of local language?
> If you really want to check
> by SID, feel free to enumerate all accounts by just omitting the username and
> scan for the SID you're looking for:
> $ getent passwd | grep ',S-1-5-32-544:'
>
> $ getent group | grep ':S-1-5-18:'
OK, thanks, that will work.
We have had cases of people in very large organizations trying to build the password with mkpasswd -d and that ended up taking hours. Won't the above run in the same issue? This needs to run in postinstall.
Pierre
next prev parent reply other threads:[~2014-02-21 21:21 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-20 19:38 Corinna Vinschen
[not found] ` <025d01cf2f2d$014b0040$03e100c0$@ieee.org>
2014-02-21 20:27 ` Corinna Vinschen
2014-02-21 21:10 ` Corinna Vinschen
2014-02-21 21:37 ` Corinna Vinschen
2014-02-21 21:21 ` Pierre A. Humblet [this message]
2014-02-21 21:42 ` Corinna Vinschen
2014-02-23 10:32 ` Corinna Vinschen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='02cb01cf2f4a$cbc90cf0$635b26d0$@ieee.org' \
--to=pierre.humblet@ieee.org \
--cc=cygwin-apps@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).