From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 53036 invoked by alias); 29 Jun 2016 15:13:35 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 51776 invoked by uid 89); 29 Jun 2016 15:13:34 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-96.3 required=5.0 tests=AWL,BAYES_00,GOOD_FROM_CORINNA_CYGWIN,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_PBL,RCVD_IN_SORBS_DUL,RDNS_DYNAMIC autolearn=ham version=3.3.2 spammy=D*vinschen.de, Nothing, 20046, 18946 X-HELO: calimero.vinschen.de Received: from ipbcc0227e.dynamic.kabel-deutschland.de (HELO calimero.vinschen.de) (188.192.34.126) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Wed, 29 Jun 2016 15:13:24 +0000 Received: by calimero.vinschen.de (Postfix, from userid 500) id 39BDCA80375; Wed, 29 Jun 2016 17:13:22 +0200 (CEST) Date: Wed, 29 Jun 2016 16:06:00 -0000 From: Corinna Vinschen To: cygwin@cygwin.com Subject: Re: POSIX permission mapping and NULL SIDs Message-ID: <20160629151322.GN981@calimero.vinschen.de> Reply-To: cygwin@cygwin.com Mail-Followup-To: cygwin@cygwin.com References: <20160624215948.GD27089@calimero.vinschen.de> <1945820393.20160627122324@yandex.ru> <20160627102614.GA8258@calimero.vinschen.de> <20160628102705.GA22797@calimero.vinschen.de> <20160629082129.GC981@calimero.vinschen.de> <20160629134515.GL981@calimero.vinschen.de> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="4eRLI4hEmsdu6Npr" Content-Disposition: inline In-Reply-To: <20160629134515.GL981@calimero.vinschen.de> User-Agent: Mutt/1.6.1 (2016-04-27) X-SW-Source: 2016-06/txt/msg00442.txt.bz2 --4eRLI4hEmsdu6Npr Content-Type: multipart/mixed; boundary="4VrXvz3cwkc87Wze" Content-Disposition: inline --4VrXvz3cwkc87Wze Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-length: 887 On Jun 29 15:45, Corinna Vinschen wrote: > Hi Bill, >=20 > On Jun 29 10:21, Corinna Vinschen wrote: > > On Jun 28 18:06, Bill Zissimopoulos wrote: > > > In any case I will use your mapping of S-1-0-65534 <-> 65534. > >=20 > > Thanks. Do you want to add handling for this mapping to > > pwdgrp::fetch_account_from_windows yourself or shall I do it? I could > > come up with a patch in the next couple of days. I will prepare a > > developer's snapshot then, so you can immediately test if it works as > > desired. >=20 > How do we avoid name collisions? I can easily see admins creating an > AD account called "nobody". >=20 > Shall we fake a "WinFSP" domain such that the name is "WinFSP+nobody"? Preliminary patch attached. Corinna --=20 Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Maintainer cygwin AT cygwin DOT com Red Hat --4VrXvz3cwkc87Wze Content-Type: text/plain; charset=utf-8 Content-Disposition: attachment; filename="0001-Handle-WinFSP-nobody-account.patch" Content-Transfer-Encoding: quoted-printable Content-length: 2096 =46rom a0bdba1cc4b8515e933e1c1caf59fcc310c48613 Mon Sep 17 00:00:00 2001 From: Corinna Vinschen Date: Wed, 29 Jun 2016 17:12:38 +0200 Subject: [PATCH] Handle WinFSP nobody account Per discussion started at https://cygwin.com/ml/cygwin/2016-06/msg00347.html S-1-0-65534 =3D=3D WinFSP\nobody =3D=3D WinFSP+nobody =3D=3D uid/gid 65534 --- winsup/cygwin/uinfo.cc | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/winsup/cygwin/uinfo.cc b/winsup/cygwin/uinfo.cc index 247131d..af1a4e5 100644 --- a/winsup/cygwin/uinfo.cc +++ b/winsup/cygwin/uinfo.cc @@ -1894,6 +1894,14 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t= &arg, cyg_ldap *pldap) } if (!ret) { + if (!strcmp (arg.name, "WinFSP+nobody")) + { + /* Special case "nobody" for reproducible construction of a + nobody SID for WinFSP. We use the value 65534 which is + -2 with 16 bit uid/gids. */ + csid.create (0, 1, 0xfffe); + break; + } debug_printf ("LookupAccountNameW (%W), %E", name); return NULL; } @@ -2004,6 +2012,15 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t= &arg, cyg_ldap *pldap) sid =3D logon_sid; break; } + else if (arg.id =3D=3D 0xfffe) + { + /* Special case "nobody" for reproducible construction of a + nobody SID for WinFSP. We use the value 65534 which is + -2 with 16 bit uid/gids. */ + csid.create (0, 1, 0xfffe); + sid =3D csid; + break; + } else if (arg.id < 0x10000) { /* Nothing. */ @@ -2428,6 +2445,14 @@ pwdgrp::fetch_account_from_windows (fetch_user_arg_t= &arg, cyg_ldap *pldap) return NULL; } }=20 + else if (sid_id_auth (sid) =3D=3D 0 && sid_sub_auth (sid, 0) =3D=3D 0xff= fe) + { + uid =3D gid =3D 0xfffe; + wcpcpy (dom, L"WinFSP"); + wcpcpy (name =3D namebuf, L"nobody"); + fully_qualified_name =3D true; + acc_type =3D SidTypeUnknown; + } else if (sid_id_auth (sid) =3D=3D 5 /* SECURITY_NT_AUTHORITY */ && sid_sub_auth (sid, 0) =3D=3D SECURITY_LOGON_IDS_RID) { --=20 2.5.5 --4VrXvz3cwkc87Wze-- --4eRLI4hEmsdu6Npr Content-Type: application/pgp-signature; name="signature.asc" Content-length: 819 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJXc+WSAAoJEPU2Bp2uRE+gnuwQAJ+tczRSTpcdREQwWxjx38D7 2iNuj4f5HYpyefNit4ECW2Lm//IcJlaG9vv4VCd2ELnf8S+eRdmjnPBruuDrn23k x/DWall656ePiFCDbVjfLFUj0SuZuX8bTbKcC2vxNAAeVZbBcmcRTbdN+/VIU8+5 wOI4R2D1jrP4b2WBaE4vUmOl3h+N6CwuxUQkbCTr+ZM32HQzZxBb9+i8ZCEQpCV/ hwbogVz0vS9xR0a8oBGv5xcKpMo90+7pzuUPxelX3lRcLEhNFpi5y1WiG8L/nmxw MLjCQuh5ycqOkMyQE0QYEv3NBEHg/6F32q3Ibz0Pg+UqTavrvdmQW+mkFaEWFHED EkxZS+S5GlrKsavmhCM6Wsou4/L/nRk0pkujzMvNMyhFhTALyrtiB3hwDIUXIkSI uEDf3ys9A54CowE4z3zm4vT0DRi1HAgwFibZb4EW8MCQASxVJgB3f3ljmBK/xmyw iMUDSAdKIU2N/xEt9ZGKKmnVgqSVDnJUfRqDR7pJBXMPGHhirK20bTMb9O5MR4Y9 IgGy4dlYRZgGGs5LFOxs7PbzkheFsk2Fpo48nBvfnUH1cnmVOENdX4MCPcjWiNk+ BIK0VJk3lsKs/11RS+DFMFhQx/e6Pt+w6NPP5eFMIh6IhuLGuvttKaguYq0wVZz2 0vGbYqai2RDsDvqhSk8z =trFt -----END PGP SIGNATURE----- --4eRLI4hEmsdu6Npr--