This is the mail archive of the
mailing list for the Cygwin project.
Re: Microsoft Accounts (was Re: Problem with "None" Group on Non-Domain Members)
- From: Andrey Repin <anrdaemon at yandex dot ru>
- To: Corinna Vinschen <cygwin at cygwin dot com>
- Date: Wed, 7 May 2014 17:53:08 +0400
- Subject: Re: Microsoft Accounts (was Re: Problem with "None" Group on Non-Domain Members)
- Authentication-results: sourceware.org; auth=none
- References: <20140505144745 dot GA6993 at calimero dot vinschen dot de> <5367ACED dot 40409 at breisch dot org> <20140505154230 dot GB7694 at calimero dot vinschen dot de> <5367B990 dot 8050907 at breisch dot org> <20140505165723 dot GM30918 at calimero dot vinschen dot de> <5367DEE5 dot 5010407 at breisch dot org> <20140506125203 dot GO30918 at calimero dot vinschen dot de> <53691564 dot 1070200 at breisch dot org> <20140506171626 dot GZ30918 at calimero dot vinschen dot de> <53692867 dot 4060305 at breisch dot org> <20140507115730 dot GE30918 at calimero dot vinschen dot de>
- Reply-to: cygwin at cygwin dot com
Greetings, Corinna Vinschen!
> I toyed around with the Microsoft Account a bit more. And here's why
> the primary group SID being identical to the user SID is not a good
> Security checks.
> For instance:
> $ echo $USER
> $ screen
> Directory /tmp/uscreens/S-VMBERT8164+local_000 must have mode 700.
> $ ls -l /tmp/uscreens/
> total 0
> drwxrwx---+ 1 VMBERT8164+local_000 VMBERT8164+local_000 0 May 7 12:44 S-VMBERT8164+local_000
> Uh Oh.
But mostly because of blind check "if it's not 700, it's wrong".
No, it's not wrong, you dumb piece of code, it's your check isn't right.
> This will be a problem with other security sensitive applications, too.
> Sshd comes to mind.
> So I guess we really should make sure the primary group SID is some
> valid group, not the user's SID.
> "None" is not an option since it's not in the user token group list.
> "Users" seems to be the best choice at first sight.
For local SAM account.
> Alternatively we could use the S-1-11-xxx SID of the Microsoft Account.
> That would be in line with the idea to have a user-specific primary
For M$ accounts, perhaps.
I'm with you on this one.
When you said I can set up a primary group for my account in SAM database,
what did you mean? The <cygwin/> magic or something more system-specific?
Andrey Repin (email@example.com) 07.05.2014, <17:49>
Sorry for my terrible english...
Problem reports: http://cygwin.com/problems.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple