Re: security.cc

2003-02-05 Thread Corinna Vinschen
Hi Pierre, On Tue, Feb 04, 2003 at 10:38:16AM -0500, Pierre A. Humblet wrote: > This patch defines a new function get_sids_info that greatly reduces > the number of passwd/group lookups, compared to the current approach. this new get_sids_info() function does reimplement the functionality of is_g

sec_acl.cc

2003-02-05 Thread Pierre A. Humblet
Corinna, This patch implements __{u,g}id32_t in sec_acl.cc and performs a few optimizations using the new argument of internal_getgroups, cygpsid and strechr. is_grp_member is now unused and will disappear in the next installment. Three remarks: 1) I changed a STANDARD_RIGHTS_ALL to STANDARD_RIG

Re: sec_acl.cc

2003-02-05 Thread Corinna Vinschen
On Wed, Feb 05, 2003 at 09:15:05AM -0500, Pierre A. Humblet wrote: > is_grp_member is now unused and will disappear in the next installment. You did it ;-) > Three remarks: > 1) I changed a STANDARD_RIGHTS_ALL to STANDARD_RIGHTS_WRITE in setacl. >Is that what you meant? I don't know what you

Re: sec_acl.cc

2003-02-05 Thread Pierre A. Humblet
At 03:50 PM 2/5/2003 +0100, Corinna Vinschen wrote: >> 1) I changed a STANDARD_RIGHTS_ALL to STANDARD_RIGHTS_WRITE in setacl. >>Is that what you meant? > >I don't know what you mean by "Is that what you meant?". What are you >referring to? However, it's incorrect. The permission to write do

Re: sec_acl.cc

2003-02-05 Thread Corinna Vinschen
On Wed, Feb 05, 2003 at 10:22:39AM -0500, Pierre A. Humblet wrote: > Well, that's more generous than alloc_sd. > In particular Everyone gets the right to change the modes or take ownership, > whenever it gets the right to write. Oh, I see what you mean. Well... ... I've checked your patch in to

Re: sec_acl.cc

2003-02-05 Thread Pierre A. Humblet
At 05:16 PM 2/5/2003 +0100, Corinna Vinschen wrote: >... I've checked your patch in together with a patch from me. It >should now be most similar to alloc_sd(). At least I hope so... Yes, that's fine. However one question remains (in setacl and alloc_sd): what good does it do to remove DELETE

Re: sec_acl.cc

2003-02-05 Thread Corinna Vinschen
On Wed, Feb 05, 2003 at 11:29:40AM -0500, Pierre A. Humblet wrote: > what good does it do to remove DELETE if unlink() does a > chmod(777) anyway, which puts it back? $ touch foo $ rm foo $ touch foo $ chmod u-w foo $ rm foo rm: remove write-protected file `foo'? y $ Corinna -- Corinna Vinschen

ntsec odds and ends

2003-02-05 Thread Pierre A. Humblet
Corinna, This is hopefully the last installment for a while. Just minor cleanups. - Now that Win95 and NT behave more similarly, there is no need for DEFAULT_UID_NT and I changed to more meaningful names. - In grp.cc, I used more explicit group names to indicate trouble. Pierre 2003-02-05 Pi

Re: sec_acl.cc

2003-02-05 Thread Corinna Vinschen
On Wed, Feb 05, 2003 at 05:37:38PM +0100, Corinna Vinschen wrote: > On Wed, Feb 05, 2003 at 11:29:40AM -0500, Pierre A. Humblet wrote: > > what good does it do to remove DELETE if unlink() does a > > chmod(777) anyway, which puts it back? > > $ touch foo > $ rm foo > $ touch foo > $ chmod u-w foo

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Christopher Faylor
Pierre or Corinna, Have either of you considered adding code to cygcheck to check for more common ntsec "problems"? At the very least, something along the lines of "your username isn't in /etc/passwd" seems like it would be worthwhile. I really would be thrilled if someone was interested in addin

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Corinna Vinschen
On Wed, Feb 05, 2003 at 11:48:34AM -0500, Christopher Faylor wrote: > Pierre or Corinna, > Have either of you considered adding code to cygcheck to check for more > common ntsec "problems"? At the very least, something along the lines > of "your username isn't in /etc/passwd" seems like it would b

Re: sec_acl.cc

2003-02-05 Thread Pierre A. Humblet
At 05:37 PM 2/5/2003 +0100, Corinna Vinschen wrote: >On Wed, Feb 05, 2003 at 11:29:40AM -0500, Pierre A. Humblet wrote: >> what good does it do to remove DELETE if unlink() does a >> chmod(777) anyway, which puts it back? > >$ touch foo >$ rm foo >$ touch foo >$ chmod u-w foo >$ rm foo >rm: remove

Re: sec_acl.cc

2003-02-05 Thread Pierre A. Humblet
At 05:45 PM 2/5/2003 +0100, Corinna Vinschen wrote: >But still, it's more correct, isn't it. That's opinion, not fact! It's also relatively convoluted code that does little, or perhaps even nothing! >Surprise, surprise. I've just tried to delete a file in Explorer with >the DELETE bit unset and

Re: sec_acl.cc

2003-02-05 Thread Corinna Vinschen
On Wed, Feb 05, 2003 at 12:02:01PM -0500, Pierre A. Humblet wrote: > At 05:45 PM 2/5/2003 +0100, Corinna Vinschen wrote: > >But still, it's more correct, isn't it. > That's opinion, not fact! It's also relatively convoluted code that does > little, or perhaps even nothing! No problem, then it's m

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Pierre A. Humblet
At 11:48 AM 2/5/2003 -0500, Christopher Faylor wrote: >Pierre or Corinna, >Have either of you considered adding code to cygcheck to check for more >common ntsec "problems"? At the very least, something along the lines >of "your username isn't in /etc/passwd" seems like it would be >worthwhile. Ch

Re: sec_acl.cc

2003-02-05 Thread Pierre A. Humblet
At 06:13 PM 2/5/2003 +0100, Corinna Vinschen wrote: > >When DELETE_CHILD is off on the parent dir, a file with DELETE can be >removed, a file w/o DELETE can't. OK, that's what I see with Explorer. However rm will delete it. That's why I don't think ~DELETE is such a good idea, it only affects Win

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Igor Pechtchanski
On Wed, 5 Feb 2003, Pierre A. Humblet wrote: > At 11:48 AM 2/5/2003 -0500, Christopher Faylor wrote: > >Pierre or Corinna, > >Have either of you considered adding code to cygcheck to check for more > >common ntsec "problems"? At the very least, something along the lines > >of "your username isn't

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Pierre A. Humblet
At 05:52 PM 2/5/2003 +0100, Corinna Vinschen wrote: > >Actually I would prefer that over this extra check, changing the >group name to "use mkpasswd". I had some hesitations too. For a while I considered changing the user name itself, but that would cause side effects. Changing the group name does

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Max Bowsher
> On Wed, 5 Feb 2003, Pierre A. Humblet wrote: >> The question of "Why is my HOME C:\ " could also be handled in >> /etc/profile. I was thinking of putting something like this in it: >> echo "Hello this is /etc/profile" >> echo "You are a new user and I will verify your configuration". >> echo "Del

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Pierre A. Humblet
At 12:31 PM 2/5/2003 -0500, Igor Pechtchanski wrote: >Pierre, > >IMHO, "No entry" is a better name for such a situation ([ug]id==-1). It >could then be documented in the FAQ. Just my 2ยข... Igor, That's something else. ls -l print 65535 when the sid cannot be mapped to a uid/gid, which is NEVER

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Christopher Faylor
On Wed, Feb 05, 2003 at 12:34:03PM -0500, Pierre A. Humblet wrote: >At 05:52 PM 2/5/2003 +0100, Corinna Vinschen wrote: >> >>Actually I would prefer that over this extra check, changing the >>group name to "use mkpasswd". > >I had some hesitations too. For a while I considered changing the >user na

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Pierre A. Humblet
At 01:30 PM 2/5/2003 -0500, Christopher Faylor wrote: >I think that initial feedback is a *great* idea but if cygcheck can >provide some kind of information that would allow diagnosing a >problem, that would be useful, too. > >Maybe it could just dump selected fields from /etc/passwd and >/etc/grou

Implementation of sched_rr_get_interval for NT systems.

2003-02-05 Thread Vaclav Haisman
Hi, this patch implements sched_rr_get_interval for NT systems. The patch consists of two parts. The first part is detection of NT server systems, NT servers have different time quanta than workstations. Unfortunately the server detection is not perfect because GetVersionEx call with OSVERSIONINF

Re: Implementation of sched_rr_get_interval for NT systems.

2003-02-05 Thread Robert Collins
On Thu, 2003-02-06 at 11:50, Vaclav Haisman wrote: > Hi, > this patch implements sched_rr_get_interval for NT systems. The patch consists > of two parts. > > The first part is detection of NT server systems, NT servers have different > time quanta than workstations. Unfortunately the server detect

Re: Implementation of sched_rr_get_interval for NT systems.

2003-02-05 Thread Igor Pechtchanski
Vaclav, On Thu, 6 Feb 2003, Vaclav Haisman wrote: > Hi, > this patch implements sched_rr_get_interval for NT systems. The patch consists > of two parts. > > The first part is detection of NT server systems, NT servers have different > time quanta than workstations. Unfortunately the server detect

Re: Implementation of sched_rr_get_interval for NT systems.

2003-02-05 Thread Christopher Faylor
On Wed, Feb 05, 2003 at 08:46:12PM -0500, Igor Pechtchanski wrote: >Vaclav, > >On Thu, 6 Feb 2003, Vaclav Haisman wrote: > >> Hi, >> this patch implements sched_rr_get_interval for NT systems. The patch consists >> of two parts. >> >> The first part is detection of NT server systems, NT servers hav

heap_chunk_in_mb patch

2003-02-05 Thread Joshua Daniel Franklin
I committed this patch to document heap_chunk_in_mb. 2003-02-05 Joshua Daniel Franklin <[EMAIL PROTECTED]> * setup-net.sgml: Add "setup-maxmem" section * setup2.sgml: New section "setup-maxmem" to document heap_chunk_in_mb Index: setup-net.sgml

Re: heap_chunk_in_mb patch

2003-02-05 Thread Christopher Faylor
On Wed, Feb 05, 2003 at 08:55:22PM -0600, Joshua Daniel Franklin wrote: >I committed this patch to document heap_chunk_in_mb. > >2003-02-05 Joshua Daniel Franklin <[EMAIL PROTECTED]> > > * setup-net.sgml: Add "setup-maxmem" section > * setup2.sgml: New section "setup-maxmem" to docume