Title: #807: sudo: do not update last usn value on rules refresh
> However, there may be another rule that is not being refreshed which usn value is
higher then the current value but lower then the value of some of the refreshed rules.
Is "which usn value is higher then the current value" part really important for
described issue to occur?
Let me rephrase it. A rule may exist in cache that has been updated on the server (thus
having entryUSN greater than cached value) that will not be refreshed because last known
USN may be already larger.
If entryUSN == cached USN, the rule has not been changed and we do not care. But you
understood the problem just right.
Also, if I understand correctly, proposed patch makes smart refresh
to fetch possibly already updated rules. Is it price paid for convenience?
Yes. There is no way to determine if there are any rules missing in the cache without this
search and filtering out the rules that are known to be updated might end up in large
filter that would just slow the query.
See the full comment at https://github.com/SSSD/sssd/pull/807#issuecomment-526059748