Re: POSIX permission mapping and NULL SIDs

[Corinna Vinschen <corinna-cygwin@cygwin.com>]

[-- Attachment #1.1: Type: text/plain, Size: 904 bytes --]

On Jun 29 15:45, Corinna Vinschen wrote:
> Hi Bill,
> 
> On Jun 29 10:21, Corinna Vinschen wrote:
> > On Jun 28 18:06, Bill Zissimopoulos wrote:
> > > In any case I will use your mapping of S-1-0-65534 <-> 65534.
> > 
> > Thanks.  Do you want to add handling for this mapping to
> > pwdgrp::fetch_account_from_windows yourself or shall I do it?  I could
> > come up with a patch in the next couple of days.  I will prepare a
> > developer's snapshot then, so you can immediately test if it works as
> > desired.
> 
> How do we avoid name collisions?  I can easily see admins creating an
> AD account called "nobody".
> 
> Shall we fake a "WinFSP" domain such that the name is "WinFSP+nobody"?

Preliminary patch attached.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

[-- Attachment #1.2: 0001-Handle-WinFSP-nobody-account.patch --]
[-- Type: text/plain, Size: 2102 bytes --]

From a0bdba1cc4b8515e933e1c1caf59fcc310c48613 Mon Sep 17 00:00:00 2001
From: Corinna Vinschen <corinna@vinschen.de>
Date: Wed, 29 Jun 2016 17:12:38 +0200
Subject: [PATCH] Handle WinFSP nobody account

Per discussion started at
https://cygwin.com/ml/cygwin/2016-06/msg00347.html

S-1-0-65534 == WinFSP\nobody == WinFSP+nobody == uid/gid 65534
---
 winsup/cygwin/uinfo.cc | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/winsup/cygwin/uinfo.cc b/winsup/cygwin/uinfo.cc
index 247131d..af1a4e5 100644
--- a/winsup/cygwin/uinfo.cc
+++ b/winsup/cygwin/uinfo.cc
@@ -1894,6 +1894,14 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t &arg, cyg_ldap *pldap)
 	}
       if (!ret)
 	{
+	  if (!strcmp (arg.name, "WinFSP+nobody"))
+	    {
+	      /* Special case "nobody" for reproducible construction of a
+		 nobody SID for WinFSP.  We use the value 65534 which is
+		 -2 with 16 bit uid/gids. */
+	      csid.create (0, 1, 0xfffe);
+	      break;
+	    }
 	  debug_printf ("LookupAccountNameW (%W), %E", name);
 	  return NULL;
 	}
@@ -2004,6 +2012,15 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t &arg, cyg_ldap *pldap)
 	  sid = logon_sid;
 	  break;
 	}
+      else if (arg.id == 0xfffe)
+	{
+	  /* Special case "nobody" for reproducible construction of a
+	     nobody SID for WinFSP.  We use the value 65534 which is
+	     -2 with 16 bit uid/gids. */
+	  csid.create (0, 1, 0xfffe);
+	  sid = csid;
+	  break;
+	}
       else if (arg.id < 0x10000)
 	{
 	  /* Nothing. */
@@ -2428,6 +2445,14 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t &arg, cyg_ldap *pldap)
 	  return NULL;
 	}
     } 
+  else if (sid_id_auth (sid) == 0 && sid_sub_auth (sid, 0) == 0xfffe)
+    {
+      uid = gid = 0xfffe;
+      wcpcpy (dom, L"WinFSP");
+      wcpcpy (name = namebuf, L"nobody");
+      fully_qualified_name = true;
+      acc_type = SidTypeUnknown;
+    }
   else if (sid_id_auth (sid) == 5 /* SECURITY_NT_AUTHORITY */
 	   && sid_sub_auth (sid, 0) == SECURITY_LOGON_IDS_RID)
     {
-- 
2.5.5


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]