On Tue, Nov 12, 2013 at 10:41:16AM +0100, Jakub Hrozek wrote:
On Mon, Nov 11, 2013 at 06:28:33PM -0500, Simo Sorce wrote:
> On Mon, 2013-11-11 at 22:03 +0100, Sumit Bose wrote:
> > On Mon, Nov 11, 2013 at 10:41:46AM -0500, Simo Sorce wrote:
> > > Why should we reserve these names ?
> > > These SID are never used for actual users anyway, so I do not understand
> > > why would you care about their names ?
> > > How would you create a collision ?
> >
> > The main purpose is to resolve the SIDs for [gs]etcifsacl. Currently the
> > output for getcifsacl with SSSD looks like:
> >
> > REVISION:0x1
> > CONTROL:0x8404
> > OWNER:S-1-5-32-544
> > GROUP:domain users(a)ad18.ipa18.devel
> > ACL:posix_test_group@ad18.ipa18.devel:ALLOWED/0x0/FULL
> > ACL:S-1-2-1:ALLOWED/0x0/READ
> > ACL:S-1-5-32-556:ALLOWED/0x0/READ
> > ACL:S-1-5-18:ALLOWED/I/FULL
> > ACL:S-1-5-32-544:ALLOWED/I/FULL
> > ACL:administrator@ad18.ipa18.devel:ALLOWED/I/FULL
> >
> > the well-Known SIDs are not resolved. With the patches it looks like:
> >
> > REVISION:0x1
> > CONTROL:0x8404
> > OWNER:Administrators@BUILTIN
> > GROUP:domain users(a)ad18.ipa18.devel
> > ACL:posix_test_group@ad18.ipa18.devel:ALLOWED/0x0/FULL
> > ACL:CONSOLE LOGON:ALLOWED/0x0/READ
> > ACL:Network Configuration Operators@BUILTIN:ALLOWED/0x0/READ
> > ACL:SYSTEM@NT AUTHORITY:ALLOWED/I/FULL
> > ACL:Administrators@BUILTIN:ALLOWED/I/FULL
> > ACL:administrator@ad18.ipa18.devel:ALLOWED/I/FULL
> >
> > Everything is resolved. Maybe I've gone a little bit to far becasuse I
> > just realized that winbind only resolves the BUILTIN SIDs:
> >
> > REVISION:0x1
> > CONTROL:0x8404
> > OWNER:BUILTIN\Administrators
> > GROUP:domain users(a)ad18.ipa18.devel
> > ACL:posix_test_group@ad18.ipa18.devel:ALLOWED/0x0/FULL
> > ACL:S-1-2-1:ALLOWED/0x0/READ
> > ACL:BUILTIN\Network Configuration Operators:ALLOWED/0x0/READ
> > ACL:S-1-5-18:ALLOWED/I/FULL
> > ACL:BUILTIN\Administrators:ALLOWED/I/FULL
> > ACL:administrator@ad18.ipa18.devel:ALLOWED/I/FULL
> >
> > setcifsacl can use the names instead of the SIDs to modify the ACLs,
> > hence it is useful to support the name-to-SID translation as well. A
> > collision might be possible if for some reason a called e.g. 'CONSOLE
> > LOGIN' is created. In this case this user is only accessible by its
> > fully qualified name.
>
> Ok I think it is fair to require the fully qualified name in that case,
> and not try to black list potentially valid names ?
Is there any other way than FQDN with an AD domain?
I'm not sure what you are thinking of, but you can use the SIDs directly
with setcifsacls?
Please note that e.g. in the blobs Windows exchanges on the RPC level
the SID authorities like 'NT AUTHORITY' or 'BUILTIN' are handled as
domain names. So I think it is valid to see them as separate domains.
bye,
Sumit
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel