Switching groups with newgrp - how to get the new group with |GetTokenInformation()| ?

[Brian Inglis]

On 2024-03-10 19:30, Dan Shelton via Cygwin wrote:
> On Sat, 9 Mar 2024 at 22:27, Glenn Strauss via Cygwin <cygwin@cygwin.com> wrote:
>> On Wed, Mar 06, 2024 at 02:01:06PM +0100, Corinna Vinschen via Cygwin wrote:
>>> On Mar  5 23:38, Dan Shelton via Cygwin wrote:
>>>> On Sat, 24 Feb 2024 at 14:11, Corinna Vinschen via Cygwin wrote:
>>>>> On Feb 23 22:15, Dan Shelton via Cygwin wrote:
>>>>>> HOWEVER, there is another Cygwin bug:
>>>>>> "getent group mywingrp1" does not list any group members, even after
>>>>>> "net localgroup mywingrp1 mywinuser44 /add", which is a POSIX
>>>>>> violation.
>>>>>
>>>>> Not a bug.  Two problems:
>>>>>
>>>>> - Getting members of a group can be an extremly costly operation
>>>>>    in a domain or, worse, a domain forest, or even worse, if the
>>>>>    domain or domain forest is remote.
>>>>>
>>>>> - Alonmg the same lines, getting members of a group can be extremly
>>>>>    costly in big orgs with thousands of users.  Nobody want's to clutter
>>>>>    up space with the list of members in the "Domain Users" group.
>>>>>
>>>>> - Permissions to enumerate members of a group are restricted.
>>>>>    By default only admins and group members are allow to enumerate
>>>>>    members and this can be restricted further by domain admins.
>>>>>
>>>>> Therefore we dropped even trying to populate gr_mem, considering
>>>>> that even in its original form on Unix systems, it's used only
>>>>> to add supplementary groups.  To do this right on Windows is even
>>>>> more costly than blindly enumerating.
>>>>>
>>>>> It's not a bug, it's a feature :)
>>>>
>>>> Could you add an option to getent so that the full lookup can be
>>>> requested via command line, pls?
>>>
>>> That's not possible.  getent just calls getpwent/getgrent.
>>>
>>>> Always editing /etc/nsswitch.conf
>>>> forth and back is not a elegant solution, aside from race conditions
>>>> with other users on a system
>>>
>>> So, here we go again.
>>>
>>> - What exactly are you trying to accomplish by enumerating the accounts?
>>>    Maybe you won't actually need it for your task at hand.
>>>
>>> - Why do you have to change nsswitch.conf "back and forth"?
>>>    Just change it once and you're done.

>>>> Always editing /etc/nsswitch.conf
>>>> forth and back is not a elegant solution, aside from race conditions
>>>> with other users on a system

Plus you need to terminate all processes in a tree and/or restart cygserver to 
pick up any changed information.

>> Please check the man page for getent.
>>
>> man getent
>> getent --help
>>
>> You can use -s or --service to override the service used without
>> editing nsswitch.conf.  The man page on Linux provides an example
>> with a bit more details than the man page for getent under cygwin.
>> https://www.man7.org/linux/man-pages/man1/getent.1.html

That web page does not even define services (and it is not the same as the 
services database), better info is available on the linked page:

	https://man7.org/linux/man-pages/man5/nsswitch.conf.5.html

but none of those Linux services/sources apply on Cygwin.

The Cygwin getent man page does not document the current implementation; and
getent --help does not explain what a service configuration is: possibly the 
same as the line you specify after db_enum, or maybe just one source?

Rely on /etc/nsswitch.conf; a bit better explanation is available if you install 
Cygwin man-pages-linux then run:

	$ man -m linux getent

and, as above, none of those Linux services/sources apply on Cygwin.

> Is this feature supported under Cygwin /usr/bin/getent?
> 
> I tried it, but did not see any change. Even putting garbage into it,
> e.g. /usr/bin/getent -s "$(man man)" group foo does not yield an
> error.

This facility is a generic lookup using certain sets of functions accessing 
information from various sources defined in comments in Cygwin's 
/etc/nsswitch.conf, so if you pass in nonsense, you just will not get a match, 
and nothing will be output.

You will only get an error if information required to perform a lookup is 
unrecognized, for example option, database, or missing, for example key, where 
enumeration is not supported.

Perhaps using meaningful commands on existing but elusive groups above like:

	$ getent -s local group mywingrp1

	$ getent -s primary group mywingrp1

may produce results that match what you should expect, and possibly even

	$ getent -s 'local primary' group mywingrp1

may produce output.

-- 
Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada

La perfection est atteinte                   Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer     but when there is no more to cut
                                 -- Antoine de Saint-Exupéry