URL: https://github.com/SSSD/sssd/pull/5404 Author: sumit-bose Title: #5404: nss: check if groups are filtered during initgroups Action: opened
PR body: """ If groups are filtered, i.e. SSSD should not handle them, they should not appear in the group list returned by an initgroups request.
Resolves: https://github.com/SSSD/sssd/issues/5403 """
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5404/head:pr5404 git checkout pr5404
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
sumit-bose commented: """ Hi,
currently the filtered groups are removed unconditionally. However I wonder, since we have the `filter_users_in_groups` option, if this behavior should be configurable as well? So we have the following options:
1. remove unconditionally 2. use `filter_users_in_groups`option here as well 3. add a new option, e.g. `filter_groups_in_memberships`
Additionally I was thinking how to handle the case where the primary group is filtered? Currently I would prefer to just ignore this and return the gid because otherwise this would mean this we have to return that the user does not exists.
bye, Sumit """
See the full comment at https://github.com/SSSD/sssd/pull/5404#issuecomment-728889443
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
Label: +branch: sssd-1-16
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
Label: +Bugzilla
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
pbrezina commented: """ `filter_groups` is quite common option so I wonder why was this reported only recently? Was it always like this or is it a regression? Do you think that there's is someone who's using this behavior? """
See the full comment at https://github.com/SSSD/sssd/pull/5404#issuecomment-732078527
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
sumit-bose commented: """
`filter_groups` is quite common option so I wonder why was this reported only recently? Was it always like this or is it a regression?
I think it was always the case. The `filterUsersInGroups` was added as a side-effect because it looks there were cases where a group was not displayed at all and we started thinking about how to handle filtered users in the member list (https://pagure.io/SSSD/sssd/issue/108). The initgroup case so far was not considered and it is only clearly visible if you carefully looks at the id output. I guess typically for a group in `filter_groups` only `getent group` is checked and that's why it wasn't reported earlier.
Do you think that there's is someone who's using this behavior?
Do you mean that somebody relies on the fact that a user can still be a member of a filtered group?
bye, Sumit
"""
See the full comment at https://github.com/SSSD/sssd/pull/5404#issuecomment-732762219
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
pbrezina commented: """
Do you think that there's is someone who's using this behavior?
Do you mean that somebody relies on the fact that a user can still be a member of a filtered group?
Yes. IMHO since you can't resolve the group's name, you'd need to work with gid only. And filtering out group only to match it by gid in user's initgroups sounds like nonsense and we can just filter it from initgroups unconditionally.
"""
See the full comment at https://github.com/SSSD/sssd/pull/5404#issuecomment-733032584
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
Label: +Waiting for review
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
sumit-bose commented: """
Do you think that there's is someone who's using this behavior?
Do you mean that somebody relies on the fact that a user can still be a member of a filtered group?
Yes. IMHO since you can't resolve the group's name, you'd need to work with gid only. And filtering out group only to match it by gid in user's initgroups sounds like nonsense and we can just filter it from initgroups unconditionally.
Ok, thanks, then the patch can be used as it is, I've set the `Waiting for Review` label. """
See the full comment at https://github.com/SSSD/sssd/pull/5404#issuecomment-733060554
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
pbrezina commented: """ Thank you. Ack. """
See the full comment at https://github.com/SSSD/sssd/pull/5404#issuecomment-735761061
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
Label: -Waiting for review
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
Label: -branch: sssd-1-16
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
Label: +Ready to push
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
Label: +Accepted
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
Label: +branch: sssd-1-16
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
pbrezina commented: """ Pushed PR: https://github.com/SSSD/sssd/pull/5404
* `master` * c87b2208b9a58c12eeceb5b8ccf9c34dcd835b8d - nss: check if groups are filtered during initgroups * `sssd-1-16` * bb736d3f02861366d11d2f03314295bd1c1be209 - nss: check if groups are filtered during initgroups
"""
See the full comment at https://github.com/SSSD/sssd/pull/5404#issuecomment-735765204
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
Label: -Accepted
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
Label: +Pushed
URL: https://github.com/SSSD/sssd/pull/5404 Title: #5404: nss: check if groups are filtered during initgroups
Label: -Ready to push
URL: https://github.com/SSSD/sssd/pull/5404 Author: sumit-bose Title: #5404: nss: check if groups are filtered during initgroups Action: closed
To pull the PR as Git branch: git remote add ghsssd https://github.com/SSSD/sssd git fetch ghsssd pull/5404/head:pr5404 git checkout pr5404
sssd-devel@lists.fedorahosted.org