Re: ntsec patch 1: uid==gid, chmod, alloc_sd, is_grp_member

2002-11-14 Thread Pierre A. Humblet
At 08:57 PM 11/14/2002 +0100, Corinna Vinschen wrote: >On Thu, Nov 14, 2002 at 08:21:05PM +0100, Corinna Vinschen wrote: >> is_grp_member() calls getgroups32() only for the current user and >> scans passwd and group otherwise, trying to be more efficient. > >Btw., it "feels" faster now to call ls -

Re: ntsec patch 1: uid==gid, chmod, alloc_sd, is_grp_member

2002-11-14 Thread Corinna Vinschen
On Thu, Nov 14, 2002 at 08:21:05PM +0100, Corinna Vinschen wrote: > is_grp_member() calls getgroups32() only for the current user and > scans passwd and group otherwise, trying to be more efficient. Btw., it "feels" faster now to call ls -l... Corinna -- Corinna Vinschen Please

Re: ntsec patch 1: uid==gid, chmod, alloc_sd, is_grp_member

2002-11-14 Thread Corinna Vinschen
On Thu, Nov 14, 2002 at 06:23:23PM +0100, Corinna Vinschen wrote: > On Thu, Nov 14, 2002 at 12:03:24PM -0500, Pierre A. Humblet wrote: > > If you are emulated, you already have the token in the cygheap->user. > > There is no need to open the thread, see how it's done e.g.in setegid. > > Good point

Re: ntsec patch 1: uid==gid, chmod, alloc_sd, is_grp_member

2002-11-14 Thread Corinna Vinschen
On Thu, Nov 14, 2002 at 12:03:24PM -0500, Pierre A. Humblet wrote: > If you are emulated, you already have the token in the cygheap->user. > There is no need to open the thread, see how it's done e.g.in setegid. Good point. > You want to know if the file owner uid is in the group of the file gid.

Re: ntsec patch 1: uid==gid, chmod, alloc_sd, is_grp_member

2002-11-14 Thread Pierre A. Humblet
Corinna Vinschen wrote: > > On Thu, Nov 14, 2002 at 09:30:01AM -0500, Pierre A. Humblet wrote: > > Corinna Vinschen wrote: > > > Isn't the impersonation token automatically read by OpenProcessToken() > > > when an impersonation took place? > > > > I don't think so. > > I just had another look int

Re: ntsec patch 1: uid==gid, chmod, alloc_sd, is_grp_member

2002-11-14 Thread Corinna Vinschen
On Thu, Nov 14, 2002 at 09:30:01AM -0500, Pierre A. Humblet wrote: > Corinna Vinschen wrote: > > Isn't the impersonation token automatically read by OpenProcessToken() > > when an impersonation took place? > > I don't think so. I just had another look into MSDN and AFAICS, we would have to call O

Re: ntsec patch 1: uid==gid, chmod, alloc_sd, is_grp_member

2002-11-14 Thread Pierre A. Humblet
Corinna Vinschen wrote: > Hello, Corinna > > Isn't the impersonation token automatically read by OpenProcessToken() > when an impersonation took place? I don't think so. > > Thus I suggest that we use the method of the patch for now, and think > > of improving is_grp_member if/as we get specifi

Re: ntsec patch 1: uid==gid, chmod, alloc_sd, is_grp_member

2002-11-14 Thread Corinna Vinschen
On Wed, Nov 13, 2002 at 10:35:09PM -0500, Pierre A. Humblet wrote: > I would say that the comparison (on your example) of the existing method > and the current patch show that the current patch better reflects the > "reality", because it only tries to do so when the actual current token > groups

Re: ntsec patch 1: uid==gid, chmod, alloc_sd, is_grp_member

2002-11-14 Thread Corinna Vinschen
On Wed, Nov 13, 2002 at 12:32:31PM -0500, Pierre A. Humblet wrote: > Corinna Vinschen wrote: > > It doesn't add any overhead which isn't already there. > > > If "already" is before the patch, it scans the group file instead of scanning > the token groups. If "already" is after the patch, it scans