[SSSD] [PATCH] Return all user members for RFC2307 groups (sssd-1.2)

Simo Sorce ssorce at redhat.com
Tue Oct 5 21:12:35 UTC 2010


On Tue, 05 Oct 2010 19:11:02 +0200
Jakub Hrozek <jhrozek at redhat.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> [PATCH 1/3] sysdb interface for adding expired user entries
> These are added instead of looking up the members.

I am not sure I like adding a uid and gid number.
I understand it makes it simpler as you can reuse the existing sysdb
interface but it makes me really nervous, I think a fake user shouldn't
have any attribute at all including gidnumber and uidnumber so that it
is clear it is a fake user.

In any case, should we decide having uidnumber=0, gidnumber=0 is an
acceptable compromise, these shouldn't be exposed as arguments in the
sysdb interface. We should just use internal values store into a macro
like FAKE_UID_NUMBER and FAKE_GID_NUMBER.

Also if you always return ok in cleanup_users_logged_in() when uid = 0
then it means you will never clean up these entries. Am I reading it
right? If so that would be a problem. Fake users can never be logged in
so you should probably return ENOENT instead ...

> [PATCH 2/3] Shortcut for save_group() to accept sysdb DNs as member
> attributes
> 
> This patch is a backport of original written by Ralf Haferkamp.

ack.

> [PATCH 3/3] Add fake users during saving of RFC2307 group
> Instead of looking up the user entries, we just add dummy expired
> users that are refreshed when they are requested with
> getpwnam/getpwuid

This looks reasonable, although a quite complex patch (due too async
sysdb unfortunately :-/).

One thing I can't see though. At the end of
sdap_process_missing_member_2307_done() you save the missing group DN
in the state->sysdb_dns[] array.
But I don't see where you use these additional names you are saving
here... I may be missing some relationship, can you shed some light ?

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list