On Mon, 2016-08-29 at 22:47 +0200, Sumit Bose wrote:
About Simo's concern. If there are groups defined in the
session_recording configuration you look up those groups with
cache_req_group_by_name_send(). As long as the groups are in the cache
and not expired they are returned directly from the cache. I think
this lookup cannot be avoided because in theory the groups name, be it
the original name or an override name, might change. And you want to
be sure that the name listed in the configuration is still a valid
group name.
My concern is that an initgroups call can be quite expensive in certain
domains where a user is a member of many groups.
If we really want to check memberships based on session recording
configuration *at query time* rather than at storing time, I would think
it would be more efficient to resolve only the group memberships of the
groups listed in the session recording configuration, and then check if
the user is member of any of those groups.
Given in general this kind of access is geared toward auditing the work
of small groups of people (admins with root access or similar), it would
probably be more efficient than calling initgroups, as it will end up
pulling a less data, less often.
If session recording is invoked often those groups will be cached so
very few lookups would be made even if many different users log into the
system. If you call initgroups instead you may end up updating several
dozen groups for each user login.
What do you think ?
Simo.
--
Simo Sorce * Red Hat, Inc * New York