On 08/29/2016 11:47 PM, Sumit Bose wrote:
Finally you call sysdb_initgroups_with_views() to get the list of groups the user is a member of and compare them with the groups form the session_recording configuration. Since you compare the DNs I think this can be improved a bit. sysdb_initgroups_with_views() does a dereference search based on the memberOf attribute of the user which holds the DNs of all the groups the user is a member of. But since you only need the DNs of the groups for the comparison you can just add the memberOf attribute to the attribute list in nss_cmd_getpwnam_search() and friends to make the DNs of the groups available in session_recording_is_enabled().
And one more question: the above basically means that we need to make sysdb_getpwnam retrieve "memberOf" as well. Do we want to do that?
If yes, do we want to do that unconditionally, or change the interface to have that optional (ugh)?
Do we want to change sysdb_enumpwent_filter (used in setpwent) to do that as well?
We went through some of this in a chat a while ago, but I just want to be sure.
Thanks!
Nick