msnfs41client: Patch to filter out unmappable SIDs, 2025-06-04
Posted by Anonymous on Wed 4th Jun 2025 20:26
raw | new post

From 66217075abd99dc9a2ab4d6847f2ff5b8bd1717e Mon Sep 17 00:00:00 2001
From: Roland Mainz <roland.mainz@nrubsig.org>
Date: Wed, 4 Jun 2025 21:15:51 +0200
Subject: [PATCH] daemon: |get_token_groups_names()| should filter out Null,
 World and LoginId SIDs

|get_token_groups_names()| should filter out Null, World and LoginId SIDs,
because the Cygwin idmapper cannot map them.

Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
---
 daemon/accesstoken.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/daemon/accesstoken.c b/daemon/accesstoken.c
index e9a8d14..6432bdb 100644
--- a/daemon/accesstoken.c
+++ b/daemon/accesstoken.c
@@ -1,6 +1,6 @@
 /*
  * NFSv4.1 client for Windows
- * Copyright (C) 2024 Roland Mainz <roland.mainz@nrubsig.org>
+ * Copyright (C) 2024-2025 Roland Mainz <roland.mainz@nrubsig.org>
  *
  * Roland Mainz <roland.mainz@nrubsig.org>
  *
@@ -221,6 +221,23 @@ bool get_token_groups_names(HANDLE tok,
             continue;
         }

+        /*
+         * Filter out groups which cannot be used as normal user or
+         * group account names (e.g. cannot be mapped by the idmapper)
+         */
+        if (IsWellKnownSid(ptgroups->Groups[i].Sid, WinNullSid)) {
+            DPRINTF(1, ("get_token_groups_names: rejecting WinNullSid\n"));
+            continue;
+        }
+        if (IsWellKnownSid(ptgroups->Groups[i].Sid, WinWorldSid)) {
+            DPRINTF(1, ("get_token_groups_names: rejecting WinWorldSid\n"));
+            continue;
+        }
+        if (IsWellKnownSid(ptgroups->Groups[i].Sid, WinLogonIdsSid)) {
+            DPRINTF(1, ("get_token_groups_names: rejecting WinLogonIdsSid\n"));
+            continue;
+        }
+
         namesize = sizeof(namebuffer)-1;
         domainbuffer_size = sizeof(domainbuffer)-1;

--
2.45.1