From: Andrey Repin <anrdaemon@yandex.ru>
To: Bill Zissimopoulos <billziss@navimatics.com>, cygwin@cygwin.com
Subject: Re: POSIX permission mapping and NULL SIDs
Date: Mon, 27 Jun 2016 10:29:00 -0000 [thread overview]
Message-ID: <1945820393.20160627122324@yandex.ru> (raw)
In-Reply-To: <D39583E5.96E3%billziss@navimatics.com>
Greetings, Bill Zissimopoulos!
>>> The main reason that I am weary of using an unused SID is that Microsoft
>>> may decide to assign some special powers to it in a future release (e.g.
>>> GodMode SID). But I agree that this is rather unlikely in the S-1-0-X
>>> namespace.
>>
>>I think it's very unlikely. We could chose any RID value we like and
>>the chance for collision is nil. When I created the new implementation
>>for POSIX ACLs, I toyed around with this already and used a special
>>Cygwin SID within the NULL SID AUTHORITY. I'm not entirely sure why I
>>changed this to the NULL SID deny ACE. I think I disliked the fact that
>>almost every Cygwin ACL would contain a mysterious "unknown SID".
> Ideally we should choose a SID that:
> (1) Is very unlikely to be used by Microsoft at any point in the future.
> (2) Cannot be associated to a user logon for any reason (see problem with
> Anonymous SID) above.
> (3) Maps to a reasonable UID in Cygwin.
> I propose the following SID/UID mapping:
> S-1-0-99 <=> UID 0xffffffff (32-bit -1)
Why not S-1-0-65535 ? It'll map to 0x1FFFF then without any special rules.
> This is a SID in the S-1-0 (Null Authority) namespace (same one that
> contains the NULL SID), which is unlikely to be used by Microsoft. So it
> likely satisfies (1).
> For the same reason (that it is a new/unused SID in the S-1-0) namespace,
> I think it also satisfies (2).
> If we follow the rules from Cygwin’s "POSIX accounts, permission, and
> security” document [IDMAP], the SID S-1-0-99 maps to 0x10063. But we can
> make a special rule for this SID to map it to a different UID. Mapping it
> to -1 may be the easiest option, but perhaps we can also consider mapping
> it to 0xfffffffe (-2).
> Bill
> [IDMAP] https://cygwin.com/cygwin-ug-net/ntsec.html
--
With best regards,
Andrey Repin
Monday, June 27, 2016 12:08:13
Sorry for my terrible english...
next prev parent reply other threads:[~2016-06-27 9:35 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-24 19:02 Bill Zissimopoulos
2016-06-24 21:37 ` Corinna Vinschen
2016-06-24 22:00 ` Corinna Vinschen
2016-06-24 22:06 ` Bill Zissimopoulos
2016-06-24 22:31 ` Corinna Vinschen
2016-06-24 22:36 ` Erik Soderquist
2016-06-24 23:03 ` Bill Zissimopoulos
2016-06-24 23:51 ` Bill Zissimopoulos
2016-06-27 13:20 ` Corinna Vinschen
2016-06-24 22:53 ` Bill Zissimopoulos
2016-06-25 17:10 ` Brian Inglis
2016-06-27 10:26 ` Bill Zissimopoulos
2016-06-27 10:29 ` Andrey Repin [this message]
2016-06-27 12:06 ` Corinna Vinschen
2016-06-27 20:31 ` Bill Zissimopoulos
2016-06-28 11:08 ` Corinna Vinschen
2016-06-28 19:17 ` Bill Zissimopoulos
2016-06-28 19:17 ` John Ruckstuhl
2016-06-29 8:43 ` Corinna Vinschen
2016-06-29 15:14 ` Corinna Vinschen
2016-06-29 16:06 ` Corinna Vinschen
2016-06-30 9:26 ` Bill Zissimopoulos
2016-06-30 14:15 ` Corinna Vinschen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1945820393.20160627122324@yandex.ru \
--to=anrdaemon@yandex.ru \
--cc=billziss@navimatics.com \
--cc=cygwin@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).