The security system available on Windows can be stricter than the security systems provided on many traditional systems. The important differences are:
From a programming standpoint, functions such as getpwnam() and getgrnam(), which take a logon or group name, now accept a domainname+username pair.
A domain is a collection of networked Windows computers that use a common security database. Most Windows computers have access to at least two domains: the network domain, which has a centralized security database; and a local domain, which uses the security database on the local computer. On domain controllers, the network and local domains are the same.
User and group names use the format domainname+username. The pw_name and gr_name members in the passwd and group structures use the format:
domainname+username
They can also be passed in the form:
+name
name
The following table describes how domain and user names are interpreted:
| Name | Description |
|---|---|
| domainname+username | The group or user name belonging to the specified domain. |
| +name | When passed to an Interix function, will find the closest matching name in the same search order used by Windows. Usually this is used with well-known names such as +SYSTEM or +Administrator, and it will find the one on the local computer. However, if the name is not found on the local computer, it will search the primary domain and other trusted domains for that name, returning the first match. When returned from and Interix function, indicates a name from the local computer domain. |
| name | The group or user name in the same domain as the calling process. |
Since the files /etc/passwd and /etc/groups do not exist, some of the information for struct passwd must be obtained in a nonstandard way. The pw_gecos (user information) member is populated with text taken from the Description field found in a Windows user account.
The content of the pw_shell member is always /bin/sh. Because other applications in both the Interix subsystem and the Win32 subsystem can use the information in those fields, you should not make assumptions about the contents of the pw_gecos member.
The Interix Software Development Kit (SDK) provides an interface with which you can execute a process as another user. These functions and structures are defined in the header file <security.h>. It includes the function authenticateuser() and six exec*_asuser() functions: execl_asuser(), execle_asuser(), execlp_asuser(), execv_asuser(), execve_asuser(), execvp_asuser().
All of these functions use a user security structure, struct usersec, to identify another user. The usersec structure is illustrated below:
struct usersec {
char * domain;
char * user;
char * password;
int logontype;
int logonprovider;
};
The meanings of domain, user, and password are just as you would expect. The logontype and logonprovider members are provided for future development; leave them at the default values of 0.
You can run a process as another user by filling in the members of the structure. Once the structure has been filled in, you can validate the data by passing it to the authenticateuser() function, which returns 0 if the data is valid and 1 if the data is not.
The six exec*_asuser() functions correspond to the six exec functions: execl(), execle(), execlp(), execv(), execve(), execvp(). The arguments after the struct usersec member are identical to their exec counterparts.