From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 26257 invoked by alias); 7 May 2014 14:09:12 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 26244 invoked by uid 89); 7 May 2014 14:09:11 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-2.4 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2 X-HELO: mail-ie0-f172.google.com Received: from mail-ie0-f172.google.com (HELO mail-ie0-f172.google.com) (209.85.223.172) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with (AES128-SHA encrypted) ESMTPS; Wed, 07 May 2014 14:09:10 +0000 Received: by mail-ie0-f172.google.com with SMTP id as1so1050710iec.17 for ; Wed, 07 May 2014 07:09:07 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :subject:references:in-reply-to:content-type :content-transfer-encoding; bh=jj5FIdifUsG5ilHfZtCG2JqNfvHHdyzrQef2VLp6gkM=; b=WgA+5Vp2uom6KKFuPuMLvX3cpND/JGRQnHhtdYIPlZr37TN4VB9+oFw331H0mvq2PV +ij2pOb9RYrKsjIvki+3a+nIsNrj7384VZgpmbZyz0sJKyL8zDifdY+4JOX85o9nSE/w sy6eQ6WYNThoICAhqTY4lRjH2YUlaV7PTxFw7LFNuSG/NtY+/fBip+miWf81h7rGjamo uEqw8zzKeq2tKaxbxqDxHyFrizC40xCggiPCP+ex1XZSihywThBZBCpar+almxyTQKpI 4tlxFckXq2G8sxPrzYIOFysLtonlhlklow7IxcZnE16wdna38x8JHWlR/Wi+4346pgSu fiHg== X-Gm-Message-State: ALoCoQlGNvBHrSpuj51909Ad3hu3SMIyvXMB9RTFsCsBT7Lnj2NeVGLj3BZ22X2ybBEEBXl0C25+ X-Received: by 10.50.61.142 with SMTP id p14mr43772470igr.12.1399471747378; Wed, 07 May 2014 07:09:07 -0700 (PDT) Received: from [10.10.15.33] ([174.47.110.34]) by mx.google.com with ESMTPSA id p4sm47760230igy.7.2014.05.07.07.09.06 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 07 May 2014 07:09:06 -0700 (PDT) Message-ID: <536A3E80.2060602@breisch.org> Date: Wed, 07 May 2014 14:09:00 -0000 From: "Chris J. Breisch" User-Agent: Postbox 3.0.9 (Windows/20140128) MIME-Version: 1.0 To: cygwin@cygwin.com Subject: Re: Microsoft Accounts (was Re: Problem with "None" Group on Non-Domain Members) References: <5367ACED.40409@breisch.org> <20140505154230.GB7694@calimero.vinschen.de> <5367B990.8050907@breisch.org> <20140505165723.GM30918@calimero.vinschen.de> <5367DEE5.5010407@breisch.org> <20140506125203.GO30918@calimero.vinschen.de> <53691564.1070200@breisch.org> <20140506171626.GZ30918@calimero.vinschen.de> <53692867.4060305@breisch.org> <20140507115730.GE30918@calimero.vinschen.de> <20140507124038.GG30918@calimero.vinschen.de> In-Reply-To: <20140507124038.GG30918@calimero.vinschen.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-IsSubscribed: yes X-SW-Source: 2014-05/txt/msg00127.txt.bz2 Corinna Vinschen wrote: > On May 7 13:57, Corinna Vinschen wrote: >> I toyed around with the Microsoft Account a bit more. And here's why >> the primary group SID being identical to the user SID is not a good >> idea: >> >> Security checks. >> >> For instance: >> >> $ echo $USER >> VMBERT8164+local_000 >> $ screen >> Directory /tmp/uscreens/S-VMBERT8164+local_000 must have mode 700. >> >> Huh? >> >> $ ls -l /tmp/uscreens/ >> total 0 >> drwxrwx---+ 1 VMBERT8164+local_000 VMBERT8164+local_000 0 May 7 12:44 S-VMBERT8164+local_000 >> >> Uh Oh. >> >> This will be a problem with other security sensitive applications, too. >> Sshd comes to mind. >> >> So I guess we really should make sure the primary group SID is some >> valid group, not the user's SID. >> >> "None" is not an option since it's not in the user token group list. >> >> "Users" seems to be the best choice at first sight. >> >> Alternatively we could use the S-1-11-xxx SID of the Microsoft Account. >> That would be in line with the idea to have a user-specific primary >> group. >> >> Thoughts? > > And here's a problem which I'm not sure how to solve at all: > > When calling the latest mkpasswd, the primary group of the local > user account backing the Microsoft Account will *still* be "None". > > The reason is that the local account is just the same old account > as usual. Its default primary group *is* "None". > > Only when logging in via the Micosoft Account email address, the > user token will not reflect what's stored in the local SAM, but > will have been changed by the OS as outlined in this thread. > > So, when a user decides to create a passwd file rather than using > the SAM/DB code in Cygwin, the information generated by mkpasswd > will not match the user token, and the primary group stored in > /etc/passwd will not even be available at all in the user token. > > I have not the faintest idea how to workaround this schizophrenia. > > > Corinna > Oh wow. It took me two reads of this to understand it. Caffeine is finally kicking in, I guess. Unless you just want to hard code the primary group that mkpasswd generates to "Users" for any account that it would tend to want to set as "None". That would be some smelly code though. -- Chris J. Breisch -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple