From c52c0c1a520cdf8509baaaaac00fa3c7bec0dd73 Mon Sep 17 00:00:00 2001
From: Justin Stephenson <jstephen@redhat.com>
Date: Fri, 26 Aug 2016 17:43:25 -0400
Subject: [PATCH 2/2]     MONITOR: Add disable_netlink option

    Adding a new monitor boolean option to disable netlink support.
    This will give users more control over sssd state changes without
    having to modify systemd unit files.

    Resolves:
    https://fedorahosted.org/sssd/ticket/3142
---
 src/confdb/confdb.h                  |  1 +
 src/config/SSSDConfig/__init__.py.in |  1 +
 src/config/SSSDConfigTest.py         |  3 ++-
 src/config/cfg_rules.ini             |  1 +
 src/config/etc/sssd.api.conf         |  1 +
 src/man/sssd.conf.5.xml              | 18 ++++++++++++++++++
 src/monitor/monitor.c                | 21 ++++++++++++++++++---
 7 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/src/confdb/confdb.h b/src/confdb/confdb.h
index 72adbd80ea534eb0becd3e517c00b0c26d00444c..f661be2f1dfda4358a8a6b9e2762ce3703b88e0d 100644
--- a/src/confdb/confdb.h
+++ b/src/confdb/confdb.h
@@ -75,6 +75,7 @@
 #define CONFDB_MONITOR_USER_RUNAS "user"
 #define CONFDB_MONITOR_PRE_KILL_CMD "diag_cmd"
 #define CONFDB_MONITOR_CERT_VERIFICATION "certificate_verification"
+#define CONFDB_MONITOR_DISABLE_NETLINK "disable_netlink"
 
 /* Both monitor and domains */
 #define CONFDB_NAME_REGEX   "re_expression"
diff --git a/src/config/SSSDConfig/__init__.py.in b/src/config/SSSDConfig/__init__.py.in
index b3f04ac26309bb5b518fb87cd0dae2962e853179..a6b9cf38d56cc690073b3e558f74f6393516b06a 100644
--- a/src/config/SSSDConfig/__init__.py.in
+++ b/src/config/SSSDConfig/__init__.py.in
@@ -64,6 +64,7 @@ option_strings = {
     'user' : _('The user to drop privileges to'),
     'certificate_verification' : _('Tune certificate verification'),
     'override_space': _('All spaces in group or user names will be replaced with this character'),
+    'disable_netlink' : _('Tune sssd to honor or ignore netlink state changes'),
 
     # [nss]
     'enum_cache_timeout' : _('Enumeration cache timeout length (seconds)'),
diff --git a/src/config/SSSDConfigTest.py b/src/config/SSSDConfigTest.py
index 8fcd1a55c36035a7026f1fb4c8116aaae24e78ef..ed14b36e0d11d43e4ada5dfd79d920e1b7cfdc0a 100755
--- a/src/config/SSSDConfigTest.py
+++ b/src/config/SSSDConfigTest.py
@@ -312,7 +312,8 @@ class SSSDConfigTestSSSDService(unittest.TestCase):
             'diag_cmd',
             'description',
             'certificate_verification',
-            'override_space']
+            'override_space',
+            'disable_netlink']
 
         self.assertTrue(type(options) == dict,
                         "Options should be a dictionary")
diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini
index df10538dee4a547a1b1af62a4cfe37b89e236b18..373bea4b2d00cc5971375d968698f5f12e9df597 100644
--- a/src/config/cfg_rules.ini
+++ b/src/config/cfg_rules.ini
@@ -40,6 +40,7 @@ option = default_domain_suffix
 option = certificate_verification
 option = override_space
 option = config_file_version
+option = disable_netlink
 
 [rule/allowed_nss_options]
 validator = ini_allowed_options
diff --git a/src/config/etc/sssd.api.conf b/src/config/etc/sssd.api.conf
index 5e69414f2a490977bdaf1555325814ad61202071..483cd7417c01aa70992971d0071a823038e09f6e 100644
--- a/src/config/etc/sssd.api.conf
+++ b/src/config/etc/sssd.api.conf
@@ -30,6 +30,7 @@ user = str, None, false
 default_domain_suffix = str, None, false
 certificate_verification = str, None, false
 override_space = str, None, false
+disable_netlink = bool, None, false
 
 [nss]
 # Name service
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index e95a7e7e213e07c15e79185730d481e5afceb69c..16a19ea92ef46feeb6e042df3dbc05dce90af064 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -482,6 +482,24 @@
                             </para>
                         </listitem>
                     </varlistentry>
+                    <varlistentry>
+                        <term>disable_netlink (boolean)</term>
+                        <listitem>
+                            <para>
+                                SSSD hooks into the netlink interface to
+                                monitor changes to routes, addresses, links
+                                and trigger certain actions.
+                            </para>
+                            <para>
+                                The SSSD state changes caused by netlink
+                                events may be undesirable and can be disabled
+                                by setting this option to 'true'
+                            </para>
+                            <para>
+                                Default: false (netlink changes are detected)
+                            </para>
+                        </listitem>
+                    </varlistentry>
                 </variablelist>
             </para>
         </refsect2>
diff --git a/src/monitor/monitor.c b/src/monitor/monitor.c
index 37c2867448bafd4113360893755f7f2bfe21f675..6972d2a52300deb10c358455f2ae2b58ca484d81 100644
--- a/src/monitor/monitor.c
+++ b/src/monitor/monitor.c
@@ -2351,6 +2351,7 @@ static int monitor_process_init(struct mt_ctx *ctx,
     int num_providers;
     int ret;
     int error;
+    bool disable_netlink;
     struct sysdb_upgrade_ctx db_up_ctx;
 
     /* Set up the environment variable for the Kerberos Replay Cache */
@@ -2471,14 +2472,28 @@ static int monitor_process_init(struct mt_ctx *ctx,
         return ret;
     }
 
-    ret = setup_netlink(ctx, ctx->ev, network_status_change_cb,
-                        ctx, &ctx->nlctx);
+    ret = confdb_get_bool(ctx->cdb,
+                          CONFDB_MONITOR_CONF_ENTRY,
+                          CONFDB_MONITOR_DISABLE_NETLINK,
+                          false, &disable_netlink);
+
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE,
-              "Cannot set up listening for network notifications\n");
+            "Failed to read disable_netlink from confdb: [%d] %s\n",
+            ret, sss_strerror(ret));
         return ret;
     }
 
+    if (disable_netlink == false) {
+        ret = setup_netlink(ctx, ctx->ev, network_status_change_cb,
+                            ctx, &ctx->nlctx);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE,
+                  "Cannot set up listening for network notifications\n");
+            return ret;
+        }
+    }
+
     /* start providers */
     num_providers = 0;
     for (dom = ctx->domains; dom; dom = get_next_domain(dom, 0)) {
-- 
2.7.4

