URL:
https://github.com/SSSD/sssd/pull/277
Author: fidencio
Title: #277: CACHE_REQ_SEARCH: Check for filtered users/groups also on cache_req_s…
Action: opened
PR body:
"""
…end()
cache_req_send() may take some shortcuts in case the object is found in
the cache and it's still valid.
This behaviour may lead to exposing filtered users and groups when
they're searched by their uid/gid.
A solution for this issue was proposed on 4ef0b19a but, unfortunately,
didn't take into consideration that this shortcut could be taken.
There are basically two really easy ways to test this issue:
1) Using enumeration:
- Set "enumerate = True" in the domain section
- restart SSSD cleaning up the cache;
- Wait a little bit till the enumerated users are cached
- id <uid of a user who is part of the filter_users>
2) Not using enumeration:
- getent passwd <uid of a user who is part of the filter_users>
- Wait a little bit till the user is cached
- id <same uid used above>
Related:
https://pagure.io/SSSD/sssd/issue/3362
Signed-off-by: Fabiano Fidêncio <fidencio(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/277/head:pr277
git checkout pr277