On Aug 7 12:19, Charles Wilson wrote: > Corinna Vinschen wrote: >> Well, hmm. In theory, admins have backup/restore rights anyway. >> However, I was just thinking that csih should get rid of points of >> failure which are not entirely necessary, like the checks for denied >> user rights. If you think the test is necessary, just stick to it. > > Well, part of the purpose of the foo-config scripts is to diagnose -- if > the foo-config script succeeds without error, then one would expect that > the installed service will, in fact, operate correctly. It's much worse to > have a user run ssh-host-config which /apparently/ succeeds, only to have > the service fail to start or operate correctly. > > So, I think /some/ version of this test should remain. However, if the > Administrators GROUP is not present in the /etc/passwd file -- that's not a > failure, so long as the Administrator and/or SYSTEM have the desired access > to the file (as well as the file's owner). > > So, I can see csih_get_system_and_admins_ids() reporting success if it > finds these three: ADMIN-GID, SYSTEM-GID, and SYSTEM-UID, and treating > ADMIN-UID (e.g. -544 in /etc/passwd) as a non-failure if missing. > > Then, csih_check_access (and all other users of ADMIN-UID) would > special-case against empty. > > We can require Administrators (-544) in /etc/group, and SYSTEM (-18) in > both /etc/group and /etc/passwd, right?
Yes. I'm just wondering if we shouldn't check for the Admins group only. The token of the SYSTEM user always contains the Admins group and the cyg_server (or whatever the name is) user is always (and should always) be created as member of the admins group, too. So, if I didn't miss anything important, the check could be reduced to checking for the admins group permissions. Does that make sense? Corinna -- Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Project Co-Leader cygwin AT cygwin DOT com Red Hat -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
