On Nov 13, 2012, at 9:06 PM, Simo Sorce <simo(a)redhat.com> wrote:
Well my concern is allowing people to get the perf. benefit you need,
as
you may not be the only one who needs it, w/o causing issues for those
apps that will use getgrnam() or getgrgid() to check stuff.
If you have a reliance on an app using getgr lookups, you probably shouldn't enable an
option called "ignore_group_members" ;). The trade off you're making for
that increased performance is that you're not going to get group members via that
interface.
I just don't see a mechanism that returns a subset of members depending on who's
happened to log in recently as desirable. From a sysadmin perspective, I'd rather it
reproducibly returns no members than return a potentially different subset on each call.
"Hmm, the app seems to work right after bob logs in but then stops working a few
hours later"...