[SSSD] [PATCH] Save dummy groups to cache during initgroups (sssd-1.2)

Simo Sorce ssorce at redhat.com
Wed Oct 6 11:56:24 UTC 2010


On Wed, 06 Oct 2010 11:24:50 +0200
Jakub Hrozek <jhrozek at redhat.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 10/05/2010 10:55 PM, Simo Sorce wrote:
> > Sorry, retiring my ack for a minor issue.
> > 
> > If these are fake groups it makes no sense to be able to pass in the
> > group GID. We should have in the header a FAKE_GID_NUMBER definition
> > and just hardcode that we assign that macro to the gidnumber.
> > 
> > So can you please change the sysdb_add_fake_group_send() interface
> > to *not* have an argument for the gid ?
> > 
> > Simo.
> > 
> 
> I think this comment makes a lot of sense for saving expired users
> and I will change my other patches accordingly.
> 
> But for saving expired groups, I wanted to also save the GID
> explicitly
> - - the main rationale being getgrouplist(3) working correctly. I
> think there's no penalty since for RFC2307 we have to lookup the
> groups anyway so we have the GID ready.

For getgroupslist you cannot use fake groups. You *must* fetch the real
groups to get the real GID.
Returnig gid = 0 would be an enormous security issue, and in general
returning any arbitrary GID would be an error.

In general I think fake groups have very limited to no use, we could
probably do without them, given that as soon as a user login you
*must* fetch all his groups anyway because you need the correct GIDs
in order to set up credentials.

Actually I am failing to see a case where using a fake group will not
result in fetching the group a second later anyway ... do you have an
example ?

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list