From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2155) id D353B3858D20; Tue, 20 Feb 2024 22:56:19 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org D353B3858D20 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1708469779; bh=2TnATUju8Xn6Un42gYFtg3kfu1TTdk5Ze4PGJWtrzKM=; h=From:To:Subject:Date:From; b=QldRiGo4y8oG2JriFiDKqwiGHTFiv/eUOIMyNYQVkVXIH4H2YHeZi9bWfO6xFM92K WTZfk4PHIT16MtK2QV+bctX6QemCeQ8qLNd2yOK388ydbY7XOxApuJaNCP68MVDVya +xHh+T1IfrhD5+WAZumxW8KkmgI9B49b0AOe2rhc= Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Corinna Vinschen To: cygwin-cvs@sourceware.org Subject: [newlib-cygwin/main] Cygwin: passwd/group: drop Capability SIDs X-Act-Checkin: newlib-cygwin X-Git-Author: Corinna Vinschen X-Git-Refname: refs/heads/main X-Git-Oldrev: 70653fd8f1db70b8776d22517fa737338eea18c7 X-Git-Newrev: 5cc69969878d1a251021a4f62907aeea05cad01f Message-Id: <20240220225619.D353B3858D20@sourceware.org> Date: Tue, 20 Feb 2024 22:56:19 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=3Dnewlib-cygwin.git;h=3D5cc69969878= d1a251021a4f62907aeea05cad01f commit 5cc69969878d1a251021a4f62907aeea05cad01f Author: Corinna Vinschen AuthorDate: Tue Feb 20 17:25:23 2024 +0100 Commit: Corinna Vinschen CommitDate: Tue Feb 20 17:25:23 2024 +0100 Cygwin: passwd/group: drop Capability SIDs =20 Capability SIDs (S-1-15-3-...) have been introduced with Windows 10 1909. They don't resolve with LookupAccountSid. We don't need them and they don't map gracefully into out POSIX account namespace. Also, add code to make sure to filter them out *iff* they become resolvable at one point. =20 While at it, slightly reorder code for non-resolving SIDs by authority values. =20 Signed-off-by: Corinna Vinschen Diff: --- winsup/cygwin/uinfo.cc | 47 +++++++++++++++++++++++++++++------------------ 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/winsup/cygwin/uinfo.cc b/winsup/cygwin/uinfo.cc index 21d729d5dcbc..acbc945e41d9 100644 --- a/winsup/cygwin/uinfo.cc +++ b/winsup/cygwin/uinfo.cc @@ -2624,9 +2624,15 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t= &arg, cyg_ldap *pldap) + (sid_sub_auth_rid (sid) & 0xff); #else if (sid_id_auth (sid) =3D=3D 15 /* SECURITY_APP_PACKAGE_AUTHORITY */) - uid =3D 0x10000 + 0x100 * sid_id_auth (sid) - + 0x10 * sid_sub_auth (sid, 0) - + (sid_sub_auth_rid (sid) & 0xf); + { + /* Filter out all SIDs not referring to an App Package, for + instance, Capability SIDs (S-1-15-3-...) */ + if (sid_sub_auth (sid, 0) !=3D SECURITY_APP_PACKAGE_BASE_RID) + return NULL; + uid =3D 0x10000 + 0x100 * sid_id_auth (sid) + + 0x10 * SECURITY_APP_PACKAGE_BASE_RID + + (sid_sub_auth_rid (sid) & 0xf); + } else if (sid_id_auth (sid) !=3D 5 /* SECURITY_NT_AUTHORITY */) uid =3D 0x10000 + 0x100 * sid_id_auth (sid) + (sid_sub_auth_rid (sid) & 0xff); @@ -2682,21 +2688,8 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t= &arg, cyg_ldap *pldap) fully_qualified_name =3D true; acc_type =3D SidTypeUnknown; } - else if (sid_id_auth (sid) =3D=3D 12 && sid_sub_auth (sid, 0) =3D=3D 1) - { - /* Special AzureAD group SID which can't be resolved by - LookupAccountSid (ERROR_NONE_MAPPED). This is only allowed - as group entry, not as passwd entry. */ - if (is_passwd ()) - return NULL; - uid =3D gid =3D 0x1001; - wcpcpy (dom, L"AzureAD"); - wcpcpy (name =3D namebuf, L"Group"); - fully_qualified_name =3D true; - acc_type =3D SidTypeUnknown; - } - else if (sid_id_auth (sid) =3D=3D 5 && - sid_sub_auth (sid, 0) =3D=3D SECURITY_APPPOOL_ID_BASE_RID) + else if (sid_id_auth (sid) =3D=3D 5 /* SECURITY_NT_AUTHORITY */ + && sid_sub_auth (sid, 0) =3D=3D SECURITY_APPPOOL_ID_BASE_RID) { /* Special IIS APPPOOL group SID which can't be resolved by LookupAccountSid (ERROR_NONE_MAPPED). This is only allowed @@ -2728,6 +2721,24 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t= &arg, cyg_ldap *pldap) } acc_type =3D SidTypeUnknown; } + else if (sid_id_auth (sid) =3D=3D 12 /* AzureAD ID */ + && sid_sub_auth (sid, 0) =3D=3D 1 /* Azure ID base RID */) + { + /* Special AzureAD group SID which can't be resolved by + LookupAccountSid (ERROR_NONE_MAPPED). This is only allowed + as group entry, not as passwd entry. */ + if (is_passwd ()) + return NULL; + uid =3D gid =3D 0x1001; + wcpcpy (dom, L"AzureAD"); + wcpcpy (name =3D namebuf, L"Group"); + fully_qualified_name =3D true; + acc_type =3D SidTypeUnknown; + } + else if (sid_id_auth (sid) =3D=3D 15 /* SECURITY_APP_PACKAGE_AUTHORITY */ + && sid_sub_auth (sid, 0) =3D=3D SECURITY_CAPABILITY_BASE_RID) + /* Filter out Capability SIDs */ + return NULL; else if (sid_id_auth (sid) =3D=3D 22) { /* Samba UNIX Users/Groups