>From 4d09fab923053504fc22b6c38f274d09768256e7 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Tue, 15 Jan 2013 07:05:56 +0100 Subject: [PATCH 1/2] NSS: invalidate memcache user entry on initgr, too https://fedorahosted.org/sssd/ticket/1757 When the user entry was missing completely after initgroups, we would never invalidate the user entry from cache. This led to dangling cache entried in memory cache if the user was removed from the server while still being in memory cache. --- src/responder/nss/nsssrv_cmd.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c index 63d82e22c2510c1c7ffa8d4b8f535d9f92bbadd7..b1db367ee1c27455d1a2216a3c63625b9ce61143 100644 --- a/src/responder/nss/nsssrv_cmd.c +++ b/src/responder/nss/nsssrv_cmd.c @@ -3410,6 +3410,7 @@ void nss_update_initgr_memcache(struct nss_ctx *nctx, TALLOC_CTX *tmp_ctx = NULL; struct sss_domain_info *dom; struct ldb_result *res; + struct sized_string delete_name; bool changed = false; uint32_t id; uint32_t gids[gnum]; @@ -3448,6 +3449,16 @@ void nss_update_initgr_memcache(struct nss_ctx *nctx, memcpy(gids, groups, gnum * sizeof(uint32_t)); if (ret == ENOENT || res->count == 0) { + /* The user is gone. Invalidate the mc record */ + to_sized_string(&delete_name, name); + ret = sss_mmap_cache_pw_invalidate(nctx->pwd_mc_ctx, &delete_name); + if (ret != EOK && ret != ENOENT) { + DEBUG(SSSDBG_CRIT_FAILURE, + ("Internal failure in memory cache code: %d [%s]\n", + ret, strerror(ret))); + } + + /* Also invalidate his groups */ changed = true; } else { /* we skip the first entry, it's the user itself */ -- 1.8.0.2