Re: CSIH patch (Re: Unable to run sshd under a domain sshd_server account [SOLVED])

[Charles Wilson <cygwin@cwilson.fastmail.fm>]

Corinna Vinschen wrote:
>> We can require Administrators (-544) in /etc/group, and SYSTEM (-18) in 
>> both /etc/group and /etc/passwd, right?
> 
> Yes.  I'm just wondering if we shouldn't check for the Admins group
> only.  The token of the SYSTEM user always contains the Admins group and
> the cyg_server (or whatever the name is) user is always (and should
> always) be created as member of the admins group, too.  So, if I didn't
> miss anything important, the check could be reduced to checking for the
> admins group permissions.  Does that make sense?

It makes sense -- if the following assertion is true for NT/2k/XP, as 
well as more modern versions of Windows, for both cygwin-1.5 and cygwin-1.7:

Admins group access to a file (-...[rwx]... as specified by $2 if group 
ownership of the file is Administrators, or a sufficient group token in 
the extended ACLs is present as determined by getfacl) is necessary and 
sufficient for the SYSTEM user (and/or the special privileged user) to 
access the file, regardless of the file's actual owner.

--
Chuck

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/