@matheusbsbs / matheus-bagliano / commits / 3f7207e2ea

mingw: handle a file owned by the Administrators group correctly

When an Administrator creates a file or directory, the created file/directory is owned not by the Administrator SID, but by the _Administrators Group_ SID. The reason is that users with administrator privileges usually run in unprivileged ("non-elevated") mode, and their user SID does not change when running in elevated mode. This is is relevant e.g. when running a GitHub workflow on a build agent, which runs in elevated mode: cloning a Git repository in a script step will cause the worktree to be owned by the Administrators Group SID, for example. Let's handle this case as following: if the current user is an administrator, Git should consider a worktree owned by the Administrators Group as if it were owned by said user. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Johannes Schindelin committed Aug 8, 2022 at 13:27 UTC 3f7207e2ea967fd2b46d9e0ae85246e93b38ed58

1 file changed +10

compat/mingw.c

+10

@@ -2728,6 +2728,7 @@ int is_path_owned_by_current_sid(const char *path, struct strbuf *report)

2728 else if (sid && IsValidSid(sid)) {

2729 /* Now, verify that the SID matches the current user's */

2730 static PSID current_user_sid;

2731 + BOOL is_member;

2732

2733 if (!current_user_sid)

2734 current_user_sid = get_current_user_sid();

@@ -2736,6 +2737,15 @@ int is_path_owned_by_current_sid(const char *path, struct strbuf *report)

2737 IsValidSid(current_user_sid) &&

2738 EqualSid(sid, current_user_sid))

2739 result = 1;

2740 + else if (IsWellKnownSid(sid, WinBuiltinAdministratorsSid) &&

2741 + CheckTokenMembership(NULL, sid, &is_member) &&

2742 + is_member)

2743 + /*

2744 + * If owned by the Administrators group, and the

2745 + * current user is an administrator, we consider that

2746 + * okay, too.

2747 + */

2748 + result = 1;

2749 else if (report &&

2750 IsWellKnownSid(sid, WinWorldSid) &&

2751 !acls_supported(path)) {