From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 21212 invoked by alias); 7 May 2014 14:05:31 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 21118 invoked by uid 89); 7 May 2014 14:05:30 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-2.4 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2 X-HELO: mail-ie0-f182.google.com Received: from mail-ie0-f182.google.com (HELO mail-ie0-f182.google.com) (209.85.223.182) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with (AES128-SHA encrypted) ESMTPS; Wed, 07 May 2014 14:05:28 +0000 Received: by mail-ie0-f182.google.com with SMTP id tp5so1042359ieb.27 for ; Wed, 07 May 2014 07:05:26 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :subject:references:in-reply-to:content-type :content-transfer-encoding; bh=kiSxWX54ydWAaU0+dYzbeOxHhB5/grAwPMYaDon06DM=; b=Nzltz3vrG9agXohGuxS4wUaz7ZjDWtXkQ/K40SicK7n+lNBlo/9DBLzJmYcmfSroHO RZYHlms/DHWWjzFXepWEkTsU3viQ/VDxDTpP0lmRLIX2R4nL8Jxx/DfM53xO03lddnIg 4bO2pkKVQ6aTTaYpqCbpTaVw5WCRZmy102bxgCf0hMHmHiUKFkxj5FvpZ/8qtbQMgWEo KGTRCYRGVmy5qWxkgpASxFpb5hYyt0CBK06ACR9FHMw9IIC8oeWhFuEK07dWo1PdQexF SNsT4481qhMc04bV6iEY9j8WJPGkpnnGIaXoPlKQtEkt73wd7BVECej+TlaWqj+HOOzh jqMw== X-Gm-Message-State: ALoCoQnIPh9t4uVJByGilTj7VUhJtneXDfiPsPwD85f4j9f5TOJoFvUPD5A1xfWjV9GWxOMU/JcT X-Received: by 10.50.92.98 with SMTP id cl2mr43915527igb.14.1399471526221; Wed, 07 May 2014 07:05:26 -0700 (PDT) Received: from [10.10.15.33] ([174.47.110.34]) by mx.google.com with ESMTPSA id kw1sm47489191igb.4.2014.05.07.07.05.25 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 07 May 2014 07:05:25 -0700 (PDT) Message-ID: <536A3DA3.8060508@breisch.org> Date: Wed, 07 May 2014 14:05:00 -0000 From: "Chris J. Breisch" User-Agent: Postbox 3.0.9 (Windows/20140128) MIME-Version: 1.0 To: cygwin@cygwin.com Subject: Re: Microsoft Accounts (was Re: Problem with "None" Group on Non-Domain Members) References: <20140505144745.GA6993@calimero.vinschen.de> <5367ACED.40409@breisch.org> <20140505154230.GB7694@calimero.vinschen.de> <5367B990.8050907@breisch.org> <20140505165723.GM30918@calimero.vinschen.de> <5367DEE5.5010407@breisch.org> <20140506125203.GO30918@calimero.vinschen.de> <53691564.1070200@breisch.org> <20140506171626.GZ30918@calimero.vinschen.de> <53692867.4060305@breisch.org> <20140507115730.GE30918@calimero.vinschen.de> In-Reply-To: <20140507115730.GE30918@calimero.vinschen.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-IsSubscribed: yes X-SW-Source: 2014-05/txt/msg00126.txt.bz2 Corinna Vinschen wrote: > On May 6 14:22, Chris J. Breisch wrote: >> Corinna Vinschen wrote: >>> On Windows, users and groups are identified not by uid/gid, but by >>> their SID. The SID is a unique value, but other than that, a SID can >>> be a user or a group and in lots of cases Windows doesn't care. >>> A group can be owner of a file and a user can be the group of the file, >>> it just doesn't matter to Windows. >>> >>> The permission "problem" you're seeing is a result of that. Your user >>> *and* your primary group are both your user's SID. Therefore the same >>> account is user and primary group at the same time. Therefore, if >>> the file is created, it gets created with an ACL with user and group >>> being the same account. Therefore the POSIX translation of the user >>> and group permissions on the file are always the same. >>> >>> Does this clear it up? >> Yes, that makes complete sense. Thank you again. > > I toyed around with the Microsoft Account a bit more. And here's why > the primary group SID being identical to the user SID is not a good > idea: > > Security checks. > > For instance: > > $ echo $USER > VMBERT8164+local_000 > $ screen > Directory /tmp/uscreens/S-VMBERT8164+local_000 must have mode 700. > > Huh? > > $ ls -l /tmp/uscreens/ > total 0 > drwxrwx---+ 1 VMBERT8164+local_000 VMBERT8164+local_000 0 May 7 12:44 S-VMBERT8164+local_000 > > Uh Oh. > > This will be a problem with other security sensitive applications, too. > Sshd comes to mind. > Yes, it was when dealing with ssh that I discovered this issue, and was the reason I brought it up. Ssh wants many of its files to be only accessible by the owner, and not any group. > So I guess we really should make sure the primary group SID is some > valid group, not the user's SID. > > "None" is not an option since it's not in the user token group list. > > "Users" seems to be the best choice at first sight. > That's what I've thought from the beginning. > Alternatively we could use the S-1-11-xxx SID of the Microsoft Account. > That would be in line with the idea to have a user-specific primary > group. > I'm not sure how that helps or even would work. Are you talking about creating a group just for Cygwin purposes that wouldn't map to an actual group on the box? Seems like I need to get some more caffeine and go back and reread your attached document from several messages ago. > Thoughts? > > > Corinna > -- Chris J. Breisch -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple