[SSSD] [PATCH] Save dummy groups to cache during initgroups (sssd-1.2)
Simo Sorce
ssorce at redhat.com
Wed Oct 6 11:56:24 UTC 2010
On Wed, 06 Oct 2010 11:24:50 +0200
Jakub Hrozek <jhrozek at redhat.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 10/05/2010 10:55 PM, Simo Sorce wrote:
> > Sorry, retiring my ack for a minor issue.
> >
> > If these are fake groups it makes no sense to be able to pass in the
> > group GID. We should have in the header a FAKE_GID_NUMBER definition
> > and just hardcode that we assign that macro to the gidnumber.
> >
> > So can you please change the sysdb_add_fake_group_send() interface
> > to *not* have an argument for the gid ?
> >
> > Simo.
> >
>
> I think this comment makes a lot of sense for saving expired users
> and I will change my other patches accordingly.
>
> But for saving expired groups, I wanted to also save the GID
> explicitly
> - - the main rationale being getgrouplist(3) working correctly. I
> think there's no penalty since for RFC2307 we have to lookup the
> groups anyway so we have the GID ready.
For getgroupslist you cannot use fake groups. You *must* fetch the real
groups to get the real GID.
Returnig gid = 0 would be an enormous security issue, and in general
returning any arbitrary GID would be an error.
In general I think fake groups have very limited to no use, we could
probably do without them, given that as soon as a user login you
*must* fetch all his groups anyway because you need the correct GIDs
in order to set up credentials.
Actually I am failing to see a case where using a fake group will not
result in fetching the group a second later anyway ... do you have an
example ?
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list