Chapter 2. Setting Up Cygwin
•
• default permissions, computed by the operating system each permission to everyone
For parameters to functions that create or open securable objects another data structure is used, the ‘security attributes’ (SA). This structure contains an SD and a flag, that specifies whether the returned handle to the created or opened object is inherited to child processes or not. This property is not important for the ntsec patch description, so in this document SDs and SAs are more or less identical.
2.6.2. Process privileges
Any process started under control of cygwin has a semaphore attached to it, that is used for signaling purposes. The creation of this semaphore can be found in sigproc.cc, function ‘getsem’. The first parameter to the function call ‘CreateSemaphore’ is an SA.
Without ntsec patch this SA assigns default security to the semaphore. There is a simple disadvantage: Only the owner of the process may send signals to it. Or, in other words, if the owner of the process is not a member of the administrators’ group, no administrator may kill the process! This is especially annoying, if processes are started via service manager.
The ntsec patch now assigns an SA to the process control semaphore, that has each permission set for the user of the process, for the administrators’ group and for
‘system’, which is a synonym for the operating system itself. The creation of this SA is done by the function ‘sec_user’, that can be found in ‘shared.cc’. Each member of the administrators’ group is now allowed to send signals to any process created in cygwin, regardless of the process owner.
Moreover, each process now has the appropriate security settings, when it is started via
‘CreateProcess’. You will find this in function ‘spawn_guts’ in module ‘spawn.cc’. The security settings for starting a process in another user context have to add the sid of the new user, too. In the case of the ‘CreateProcessAsUser’ call, sec_user creates an SA with an additional entry for the sid of the new user.
26
Chapter 2. Setting Up Cygwin
2.6.3. File permissions
If ntsec is turned on, file permissions are set as in UNIX. An SD is assigned to the file containing the owner and group and ACEs for the owner, the group and ‘Everyone’.
The complete settings of UNIX like permissions can be found in the file ‘security.cc’.
The two functions ‘get_nt_attribute’ and ‘set_nt_attribute’ are the main code. The reading and writing of the SDs is done by the functions ‘read_sd’ and ‘write_sd’.
‘write_sd’ uses the function ‘BackupRead’ instead of the simpler function
‘SetFileSecurity’ because the latter is unable to set owners different from the caller.
If you are creating a file ‘foo’ outside of cygwin, you will see something like the following on ls -ln:
If your login is member of the administrators’ group: rwxrwxrwx 1 544 513 ... foo if not: rwxrwxrwx 1 1000 513 ... foo
Note the user and group IDs. 544 is the UID of the administrators’ group. This is a
‘feature’ :-P of WinNT. If one is a member of the administrators’ group, every file, that he has created is owned by the administrators’ group, instead by him.
The second example shows the UID of the first user, that has been created with NT’s the user administration tool. The users and groups are sequentially numbered, starting with 1000. Users and groups are using the same numbering scheme, so a user and a group don’t share the same ID.
In both examples the GID 513 is of special interest. This GID is a well known group with different naming in local systems and domains. Outside of domains the group is named ’None’ (‘Kein’ in German, ‘Aucun’ in French, etc.), in domains it is named
’Domain Users’. Unfortunately, the group ‘None’ is never shown in the user admin tool outside of domains! This is very confusing but it seems that this has no negativ influences.
27
Chapter 2. Setting Up Cygwin
To work correctly the ntsec patch depends on reasoned files /etc/passwd/ and
/etc/group . In cygwin release 1.0 the names and the IDs must correspond to the appropriate NT IDs! The IDs used in cygwin are the RID of the NT SID, as mentioned earlier. An SID of e.g. the user ‘corinna’ on my NT workstation:
S-1-5-21-165875785-1005667432-441284377-1000
Note the last number: It’s the RID 1000, the cygwin’s UID.
Unfortunately, workstations and servers outside of domains are not able to set primary groups! In these cases, where there is no correlation of users to primary groups, NT returns 513 (None) as primary group, regardless of the membership to existing local groups.
when using mkpasswd -l -g on such systems, you have to change the primary group by hand if ‘None’ as primary group is not what you want (and I’m sure, it’s not what you want!)
To get help in creating correct passwd and group files, look at the following examples, that are part of my files. With the exception of my personal user entry, all entries are well known entries. For a better understanding, the names are translated to the equivalents of the English NT version.
Example 2-1. /etc/passwd everyone:*:0:0::: system:*:18:18::: administrator::500:544::/home/root:/bin/bash guest:*:501:546::: administrators:*:544:544::/home/root: corinna::1000:547:Corinna Vinschen:/home/corinna:/bin/tcsh
Example 2-2. /etc/group everyone::0: system::18: none::513:
28
