https://sourceware.org/git/gitweb.cgi?p=newlib-cygwin.git;h=8551226961429cc6810286b01ba4430f01c7d807
commit 8551226961429cc6810286b01ba4430f01c7d807 Author: Corinna Vinschen <cori...@vinschen.de> Date: Mon Mar 4 20:30:37 2019 +0100 Cygwin: seteuid: do not verify lsaprivkeyauth token We don't support setting groups via /etc/groups anymore. Also, the initgroups group list is created via S4U, so we have "Interactive" vs. "Network" token, an artificial and entirely irrelevant difference. So, "verifying" the lsaprivkeyauth token may lead to rejecting a prefectly valid token. Just remove the verify_token call. Signed-off-by: Corinna Vinschen <cori...@vinschen.de> Diff: --- winsup/cygwin/syscalls.cc | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/winsup/cygwin/syscalls.cc b/winsup/cygwin/syscalls.cc index 172b7c4..a914ae8 100644 --- a/winsup/cygwin/syscalls.cc +++ b/winsup/cygwin/syscalls.cc @@ -3552,18 +3552,7 @@ seteuid32 (uid_t uid) LSA module, or, as last chance, NtCreateToken. */ if (new_token == NULL) { - new_token = lsaprivkeyauth (pw_new); - if (new_token) - { - /* We have to verify this token since settings in /etc/group - might render it unusable im terms of group membership. */ - if (!verify_token (new_token, usersid, groups)) - { - CloseHandle (new_token); - new_token = NULL; - } - } - if (!new_token) + if (!(new_token = lsaprivkeyauth (pw_new))) { NTSTATUS status; WCHAR domain[MAX_DOMAIN_NAME_LEN + 1];