[SSSD] [PATCH] Fix initgroup processing for RFC2307 (sssd-1.2)

Jakub Hrozek jhrozek at redhat.com
Fri Oct 8 07:52:07 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/08/2010 02:18 AM, Stephen Gallagher wrote:
> Something I've been noticing during my testing: these fake groups are
> created with a dataExpireTimestamp of "one second ago". This means
> they're being reaped by the cleanup task. Is there any reason why fake
> groups can't just be created with dataExpireTimestamp=0 (reset when the
> real group is requested)?
> 

Are they really reaped though or does the cleanup code just find them
because they are expired?

Speaking in terms of what would be in the debug logs, if the cleanup
code finds an expired group, it outputs something like:

DEBUG(4, ("Found %d expired group entries!\n", state->count));

but then it goes on and checks if any users are members of these groups
(the filter is memberof=group_dn). If no users like this are found, we
really proceed with deleting the groups, if there is a memberof link, we
keep them. Deleting should emit a debug message such as:

DEBUG(8, ("About to delete group %s\n", name));

In case of initgroups, deletion should never happen as the user saved
during the operation should link to the group. If they are really
reaped, I think that is a bug.

If we set dataExpireTimestamp=0 we would never clean the expired group,
even if the user entry went away until the group is refreshed and real
timestamps are set.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkyuzacACgkQHsardTLnvCUmjQCgsnsLAKkljtJtRU68uK07fSal
dNUAoJn7EHMZewXT86xia8wIBjmCpzyI
=ZkvK
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list