On Wed, 06 Oct 2010 11:24:50 +0200
Jakub Hrozek <jhrozek(a)redhat.com> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/05/2010 10:55 PM, Simo Sorce wrote:
> Sorry, retiring my ack for a minor issue.
>
> If these are fake groups it makes no sense to be able to pass in the
> group GID. We should have in the header a FAKE_GID_NUMBER definition
> and just hardcode that we assign that macro to the gidnumber.
>
> So can you please change the sysdb_add_fake_group_send() interface
> to *not* have an argument for the gid ?
>
> Simo.
>
I think this comment makes a lot of sense for saving expired users
and I will change my other patches accordingly.
But for saving expired groups, I wanted to also save the GID
explicitly
- - the main rationale being getgrouplist(3) working correctly. I
think there's no penalty since for RFC2307 we have to lookup the
groups anyway so we have the GID ready.
For getgroupslist you cannot use fake groups. You *must* fetch the real
groups to get the real GID.
Returnig gid = 0 would be an enormous security issue, and in general
returning any arbitrary GID would be an error.
In general I think fake groups have very limited to no use, we could
probably do without them, given that as soon as a user login you
*must* fetch all his groups anyway because you need the correct GIDs
in order to set up credentials.
Actually I am failing to see a case where using a fake group will not
result in fetching the group a second later anyway ... do you have an
example ?
Simo.
--
Simo Sorce * Red Hat, Inc * New York