Re: CSIH patch (Re: Unable to run sshd under a domain sshd_server account [SOLVED])

[Corinna Vinschen <corinna-cygwin@cygwin.com>]

On Aug  7 12:19, Charles Wilson wrote:
> Corinna Vinschen wrote:
>> Well, hmm.  In theory, admins have backup/restore rights anyway.
>> However, I was just thinking that csih should get rid of points of
>> failure which are not entirely necessary, like the checks for denied
>> user rights.  If you think the test is necessary, just stick to it.
>
> Well, part of the purpose of the foo-config scripts is to diagnose -- if 
> the foo-config script succeeds without error, then one would expect that 
> the installed service will, in fact, operate correctly.  It's much worse to 
> have a user run ssh-host-config which /apparently/ succeeds, only to have 
> the service fail to start or operate correctly.
>
> So, I think /some/ version of this test should remain. However, if the 
> Administrators GROUP is not present in the /etc/passwd file -- that's not a 
> failure, so long as the Administrator and/or SYSTEM have the desired access 
> to the file (as well as the file's owner).
>
> So, I can see csih_get_system_and_admins_ids() reporting success if it 
> finds these three: ADMIN-GID, SYSTEM-GID, and SYSTEM-UID, and treating 
> ADMIN-UID (e.g. -544 in /etc/passwd) as a non-failure if missing.
>
> Then, csih_check_access (and all other users of ADMIN-UID) would 
> special-case against empty.
>
> We can require Administrators (-544) in /etc/group, and SYSTEM (-18) in 
> both /etc/group and /etc/passwd, right?

Yes.  I'm just wondering if we shouldn't check for the Admins group
only.  The token of the SYSTEM user always contains the Admins group and
the cyg_server (or whatever the name is) user is always (and should
always) be created as member of the admins group, too.  So, if I didn't
miss anything important, the check could be reduced to checking for the
admins group permissions.  Does that make sense?


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/