Re: Group Permissions on root folders problem (Windows 10 TP build 10061)

[Takashi Yano <takashi.yano@nifty.ne.jp>]

Hi Corinna,

On Fri, 11 Sep 2015 13:10:12 +0200
Corinna Vinschen wrote:
> In theory, yes.  The problem is just that checking the uid/gid equality
> is not safe, given that you can easily create that via passwd/group
> files.  What I was thinking of is to convert the uid/gid values into
> SIDs using the `getent' tool and to compare those, along the lines of
> 
>   uid=$(/usr/bin/stat -c '%u')
>   user_sid=$(getent passwd -w $uid | awk -F: '{print $4}')
>   gid=$(/usr/bin/stat -c '%g')
>   grp_sid=$(getent group -w $gid | awk -F: '{print $4}')
>   if [ "${user_sid}" = "${grp_sid}" ]
>     ...
> 
> Can you check if that works in your env and perhaps create a new patch
> using the SIDs?

I have made a new patch and confirmed that it also works.


--- cygwin-service-installation-helper.sh.orig	2015-02-24 04:57:56.000000000 +0900
+++ cygwin-service-installation-helper.sh	2015-09-11 21:30:08.539361900 +0900
@@ -2442,6 +2442,12 @@
 # ======================================================================
 _csih_setup()
 {
+  local uid
+  local gid
+  local user_sid
+  local grp_sid
+  local perms="d..x..x..[xt]"
+
   csih_stacktrace "${@}"
   $_csih_trace
   if [ "$_csih_setup_already_called" -eq 0 ]
@@ -2462,7 +2468,17 @@
       csih_error "Problem with LocalSystem or Adminstrator IDs"
     fi
 
-    if ! csih_check_dir_perms "${LOCALSTATEDIR}" "d..x..x..[xt]"
+    uid=$(/usr/bin/stat -c '%u' ${LOCALSTATEDIR})
+    gid=$(/usr/bin/stat -c '%g' ${LOCALSTATEDIR})
+    user_sid=$(/usr/bin/getent -w passwd $uid | awk -F: '{print $4}')
+    grp_sid=$(/usr/bin/getent -w group $gid | awk -F: '{print $4}')
+
+    if [ "${user_sid}" = "${grp_sid}" ]
+    then
+      perms="d..x.....[xt]"
+    fi
+
+    if ! csih_check_dir_perms "${LOCALSTATEDIR}" "${perms}"
     then
       csih_error "Problem with ${LOCALSTATEDIR} directory. Exiting."
     fi



-- 
Takashi Yano <takashi.yano@nifty.ne.jp>

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple