Como posso obter automaticamente os grupos correspondentes aos Administradores em um shell cygwin?

Question

Minha conta de usuário comum faz parte do grupo de administradores.

Quando inicio um shell do cygwin usando o mintty, não obtenho o nome do grupo correspondente ao grupo de administradores no meu conjunto de grupos. Aqui está o conjunto de grupos.

gid=197121(None) groups=197121(None),545(Users),4(INTERACTIVE),66049(CONSOLE LOGON),
11(Authenticated Users),15(This Organization),113(Local account),
66048(LOCAL),262154(NTLM Authentication),401408(Medium Mandatory Level)

Quando inicio um shell cygwin usando a opção "Executar como administrador", recebo o nome do grupo correspondente ao grupo de administradores no meu conjunto de grupos. Aqui está o conjunto de grupos.

 gid=197121(None) groups=197121(None),114(Local account and member of Administrators group),
 544(Administrators),545(Users),4(INTERACTIVE),66049(CONSOLE LOGON),
 11(Authenticated Users),15(This Organization),113(Local account),
 66048(LOCAL),262154(NTLM Authentication),405504(High Mandatory Level)

Existe algo que eu possa fazer para obter os grupos 114 (conta local e membro do grupo Administradores) e 544 (Administradores) no meu conjunto de grupos quando eu inicio um shell cygwin sem usar "Executar como Administrador"?

    

Answer 1

Você poderia falsificá-lo com algum ajuste no arquivo /etc/passwd . Essa possibilidade foi mencionada na lista de discussão do cygwin no início deste ano:

Re: Change PS1 when run as administrator

    From: Corinna Vinschen <corinna-cygwin at cygwin dot com>
    To: cygwin at cygwin dot com
    Date: Wed, 23 Mar 2016 15:17:40 +0100
    Subject: Re: Change PS1 when run as administrator
    Authentication-results: sourceware.org; auth=none
    References: <F7CDFE45-BFA7-4599-B510-B40BCA19142F at etr-usa dot com> <28210846 dot 20160315202354 at yandex dot ru> <87mvpz1ong dot fsf at Rainer dot invalid> <0F37E0B7-A313-49F2-BAFD-59A7A144BD8C at etr-usa dot com> <loom dot 20160323T125711-592 at post dot gmane dot org>
    Reply-to: cygwin at cygwin dot com

On Mar 23 12:35, Brian Inglis wrote:
> Warren Young <wyml <at> etr-usa.com> writes:
> > On Mar 15, 2016, at 2:17 PM, Achim Gratz <Stromeko <at> nexgo.de> wrote:
> >> Andrey Repin writes:
> >>>    test $group -eq 114 && { x="#"; break; }
> >> Nope, that group membership isn't associated with real administrative
> >> powers.
> > Confirmed, at least on Win10 64-bit without any AD mucking things up.
> > That is, I get both 114 and 544 here, so I donât need the 114 rule at all.
> 
> Opposite for me on Win7 x64 non-domain machine! 
> I am always a member of 544(Administrators) group and it is my default
> primary group in normal non-admin and elevated admin shells. 
> 
> In elevated admin shell, I am also a member of 114(Local account and member
> of Administrators group) and 405504(High Mandatory Level) not 401408(Medium
> Mandatory Level). 
> 
> No idea how this works in domains and with domain accounts, but perhaps
> checking for 114 and/or 405504 would be more portable? 
> 
> $ uname -srvmo
> CYGWIN_NT-6.1 2.4.1(0.293/5/3) 2016-01-24 11:26 x86_64 Cygwin
> 
> normal non-admin shell:
> $ id
> uid=... gid=544(Administrators)
> groups=544(Administrators),197121(None),197610(HomeUsers),545(Users),
> 4(INTERACTIVE),66049(CONSOLE
> LOGON),11(Authenticated Users),15(This Organization),113(Local
> account),4095(CurrentSession),66048(LOCAL),262154(NTLM
> Authentication),401408(Medium Mandatory Level)

You have either some /etc/passwd, /etc/group settings overshadowing the
default settings, or you used the "desc" method described in
https://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-mapping-nsswitch-desc
to change your primary group.

Otherwise your primary group is always "None", or the equivalent in your
locale.  The admins group is *never* the primary group, unless you
messed with the settings for Cygwin as outlined above.

If you're member in the Admins group, then the admins group is part of
the non-elevated token, but only as "deny-only" group.  That means, it's
usually not shown in id, unless you made it primary group, in which case
it has to be shown.

You better remove this.  I think I'll fix this function to not allow
primary groups wehich are not enabled in the token.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

Mas isso não afetaria sua capacidade de realizar tarefas administrativas nesse shell.