From bb6f800d1840dfb870fa5af01c5884317330bdf6 Mon Sep 17 00:00:00 2001 From: Corinna Vinschen Date: Thu, 2 Feb 2006 11:35:52 +0000 Subject: * security.cc (is_group_member): Fix comment. --- winsup/cygwin/security.cc | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'winsup/cygwin/security.cc') diff --git a/winsup/cygwin/security.cc b/winsup/cygwin/security.cc index 5bb067f56..f0deda11b 100644 --- a/winsup/cygwin/security.cc +++ b/winsup/cygwin/security.cc @@ -388,11 +388,12 @@ is_group_member (WCHAR *wgroup, PSID pusersid, cygsidlist &grp_list) Administrators or Users) can be members of local groups, even though MSDN states otherwise. The GUI refuses to put aliases into local groups, but the CLI interface allows it. However, a normal - logon token does not contain those 2nd order aliases, so we also - should not put them into the token group list. - Note: Allowing those 2nd order aliases in our group list renders - external tokens invalid, so that it becomes impossible to logon - with password and valid logon token. */ + logon token does not contain groups, in which the user is only + indirectly a member by being a member of an alias in this group. + So we also should not put them into the token group list. + Note: Allowing those groups in our group list renders external + tokens invalid, so that it becomes impossible to logon with + password and valid logon token. */ for (int glidx = 0; glidx < grp_list.count; ++glidx) if ((buf[bidx].lgrmi1_sidusage == SidTypeGroup || buf[bidx].lgrmi1_sidusage == SidTypeWellKnownGroup) -- cgit v1.2.3