Re: security.cc

2003-02-05 Thread Corinna Vinschen
Hi Pierre, On Tue, Feb 04, 2003 at 10:38:16AM -0500, Pierre A. Humblet wrote: This patch defines a new function get_sids_info that greatly reduces the number of passwd/group lookups, compared to the current approach. this new get_sids_info() function does reimplement the functionality of

Re: sec_acl.cc

2003-02-05 Thread Corinna Vinschen
On Wed, Feb 05, 2003 at 09:15:05AM -0500, Pierre A. Humblet wrote: is_grp_member is now unused and will disappear in the next installment. You did it ;-) Three remarks: 1) I changed a STANDARD_RIGHTS_ALL to STANDARD_RIGHTS_WRITE in setacl. Is that what you meant? I don't know what you

Re: sec_acl.cc

2003-02-05 Thread Corinna Vinschen
On Wed, Feb 05, 2003 at 10:22:39AM -0500, Pierre A. Humblet wrote: Well, that's more generous than alloc_sd. In particular Everyone gets the right to change the modes or take ownership, whenever it gets the right to write. Oh, I see what you mean. Well... ... I've checked your patch in

Re: sec_acl.cc

2003-02-05 Thread Pierre A. Humblet
At 05:16 PM 2/5/2003 +0100, Corinna Vinschen wrote: ... I've checked your patch in together with a patch from me. It should now be most similar to alloc_sd(). At least I hope so... Yes, that's fine. However one question remains (in setacl and alloc_sd): what good does it do to remove DELETE

Re: sec_acl.cc

2003-02-05 Thread Corinna Vinschen
On Wed, Feb 05, 2003 at 11:29:40AM -0500, Pierre A. Humblet wrote: what good does it do to remove DELETE if unlink() does a chmod(777) anyway, which puts it back? $ touch foo $ rm foo $ touch foo $ chmod u-w foo $ rm foo rm: remove write-protected file `foo'? y $ Corinna -- Corinna Vinschen

Re: sec_acl.cc

2003-02-05 Thread Corinna Vinschen
On Wed, Feb 05, 2003 at 05:37:38PM +0100, Corinna Vinschen wrote: On Wed, Feb 05, 2003 at 11:29:40AM -0500, Pierre A. Humblet wrote: what good does it do to remove DELETE if unlink() does a chmod(777) anyway, which puts it back? $ touch foo $ rm foo $ touch foo $ chmod u-w foo $ rm foo

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Christopher Faylor
Pierre or Corinna, Have either of you considered adding code to cygcheck to check for more common ntsec problems? At the very least, something along the lines of your username isn't in /etc/passwd seems like it would be worthwhile. I really would be thrilled if someone was interested in adding

Re: sec_acl.cc

2003-02-05 Thread Pierre A. Humblet
At 05:45 PM 2/5/2003 +0100, Corinna Vinschen wrote: But still, it's more correct, isn't it. That's opinion, not fact! It's also relatively convoluted code that does little, or perhaps even nothing! Surprise, surprise. I've just tried to delete a file in Explorer with the DELETE bit unset and

Re: sec_acl.cc

2003-02-05 Thread Corinna Vinschen
On Wed, Feb 05, 2003 at 12:02:01PM -0500, Pierre A. Humblet wrote: At 05:45 PM 2/5/2003 +0100, Corinna Vinschen wrote: But still, it's more correct, isn't it. That's opinion, not fact! It's also relatively convoluted code that does little, or perhaps even nothing! No problem, then it's my

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Pierre A. Humblet
At 11:48 AM 2/5/2003 -0500, Christopher Faylor wrote: Pierre or Corinna, Have either of you considered adding code to cygcheck to check for more common ntsec problems? At the very least, something along the lines of your username isn't in /etc/passwd seems like it would be worthwhile. Chris, I

Re: sec_acl.cc

2003-02-05 Thread Pierre A. Humblet
At 06:13 PM 2/5/2003 +0100, Corinna Vinschen wrote: When DELETE_CHILD is off on the parent dir, a file with DELETE can be removed, a file w/o DELETE can't. OK, that's what I see with Explorer. However rm will delete it. That's why I don't think ~DELETE is such a good idea, it only affects

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Pierre A. Humblet
At 05:52 PM 2/5/2003 +0100, Corinna Vinschen wrote: Actually I would prefer that over this extra check, changing the group name to use mkpasswd. I had some hesitations too. For a while I considered changing the user name itself, but that would cause side effects. Changing the group name doesn't

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Max Bowsher
On Wed, 5 Feb 2003, Pierre A. Humblet wrote: The question of Why is my HOME C:\ could also be handled in /etc/profile. I was thinking of putting something like this in it: echo Hello this is /etc/profile echo You are a new user and I will verify your configuration. echo Delete these lines

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Pierre A. Humblet
At 12:31 PM 2/5/2003 -0500, Igor Pechtchanski wrote: Pierre, IMHO, No entry is a better name for such a situation ([ug]id==-1). It could then be documented in the FAQ. Just my 2ยข... Igor, That's something else. ls -l print 65535 when the sid cannot be mapped to a uid/gid, which is NEVER the

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Christopher Faylor
On Wed, Feb 05, 2003 at 12:34:03PM -0500, Pierre A. Humblet wrote: At 05:52 PM 2/5/2003 +0100, Corinna Vinschen wrote: Actually I would prefer that over this extra check, changing the group name to use mkpasswd. I had some hesitations too. For a while I considered changing the user name itself,

Re: ntsec odds and ends (cygcheck augmentation?)

2003-02-05 Thread Pierre A. Humblet
At 01:30 PM 2/5/2003 -0500, Christopher Faylor wrote: I think that initial feedback is a *great* idea but if cygcheck can provide some kind of information that would allow diagnosing a problem, that would be useful, too. Maybe it could just dump selected fields from /etc/passwd and /etc/group. I

Implementation of sched_rr_get_interval for NT systems.

2003-02-05 Thread Vaclav Haisman
Hi, this patch implements sched_rr_get_interval for NT systems. The patch consists of two parts. The first part is detection of NT server systems, NT servers have different time quanta than workstations. Unfortunately the server detection is not perfect because GetVersionEx call with

Re: Implementation of sched_rr_get_interval for NT systems.

2003-02-05 Thread Christopher Faylor
On Wed, Feb 05, 2003 at 08:46:12PM -0500, Igor Pechtchanski wrote: Vaclav, On Thu, 6 Feb 2003, Vaclav Haisman wrote: Hi, this patch implements sched_rr_get_interval for NT systems. The patch consists of two parts. The first part is detection of NT server systems, NT servers have different

heap_chunk_in_mb patch

2003-02-05 Thread Joshua Daniel Franklin
I committed this patch to document heap_chunk_in_mb. 2003-02-05 Joshua Daniel Franklin [EMAIL PROTECTED] * setup-net.sgml: Add setup-maxmem section * setup2.sgml: New section setup-maxmem to document heap_chunk_in_mb Index: setup-net.sgml

Re: heap_chunk_in_mb patch

2003-02-05 Thread Christopher Faylor
On Wed, Feb 05, 2003 at 08:55:22PM -0600, Joshua Daniel Franklin wrote: I committed this patch to document heap_chunk_in_mb. 2003-02-05 Joshua Daniel Franklin [EMAIL PROTECTED] * setup-net.sgml: Add setup-maxmem section * setup2.sgml: New section setup-maxmem to document