On Feb 23 14:03, Roland Mainz via Cygwin wrote: > On Thu, Feb 22, 2024 at 8:11 PM Corinna Vinschen via Cygwin > <cygwin@cygwin.com> wrote: > > On Feb 22 18:38, Roland Mainz via Cygwin wrote: > > > If I switch the current user's group with /usr/bin/newgrp, how can a > > > (native) Win32 process use > > > |GetTokenInformation(GetCurrentThreadToken(), ...)| to find out which > > > group is the new "current group" (e.g. which |TokenInformationClass| > > > should I use) ? > > > > PSID sidbuf = (PSID) alloca (SECURITY_MAX_SID_SIZE); > > NTSTATUS status; > > ULONG size; > > > > status = NtQueryInformationToken (hProcToken, TokenPrimaryGroup, > > sidbuf, SECURITY_MAX_SID_SIZE, > > &size); > > Well, it works in the case of an "hello world" application, but if I > stuff that into the nfsd_daemon (NFSv4.1 ms-nfs41-client client > daemon) it always prints the default primary group, even if the > current thread should impersonate another user - or in this case even > the same user, but a different primary group (e.g. see > https://github.com/kofemann/ms-nfs41-client/blob/master/sys/nfs41_driver.c#L1367). > > Do you have any idea what is going wrong in this case ?
Not sure about that. I'm not familiar with driver development under Windows. I'd expect that you get the token of the calling thread or, in this case, process as is. However, did you try this with a primary group SID being part of the token's supplementary group list, or did you try this with some arbitrary group SID? I toyed around a bit with this in user space, and it seems I misinterpreted the results when I added the newgrp(1) tool. The primary group in the token *must* be member of the token's supplementary group list. The fact that it looks like it works in Cygwin to set the pgrp to an arbitrary SID is apparently based on incorrect error handling. I will fix this in the next couple of days. Corinna -- Problem reports: https://cygwin.com/problems.html FAQ: https://cygwin.com/faq/ Documentation: https://cygwin.com/docs.html Unsubscribe info: https://cygwin.com/ml/#unsubscribe-simple
