[SSSD] [PATCH] Skip groups with multiple names

Sumit Bose sbose at redhat.com
Tue Mar 15 10:34:37 UTC 2011


On Mon, Mar 14, 2011 at 01:51:21PM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> It is impossible to predict which name to use for a group if the
> attribute used for name contains multiple values. We will log and
> skip over these groups
> 
> Fixes https://fedorahosted.org/sssd/ticket/823
> 
> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk1+VZkACgkQeiVVYja6o6PVVQCfRLTTWephEUGOYZA5xyrJdcCu
> 5tIAmQHZb6yj0YSIluTMqtmIMVxpe3MX
> =Pjxm
> -----END PGP SIGNATURE-----

> --- a/src/providers/ldap/sdap_async_accounts.c
> +++ b/src/providers/ldap/sdap_async_accounts.c
> @@ -1900,9 +1900,12 @@ static errno_t sdap_add_incomplete_groups(struct sysdb_ctx *sysdb,
>              ret = sysdb_attrs_get_string(ldap_groups[ai],
>                                           SYSDB_NAME,
>                                           &name);
> -            if (ret) {
> +            if (ret && ret != ERANGE) {
>                  DEBUG(1, ("The group has no name attribute\n"));
>                  goto fail;
> +            } else if (ret == ERANGE) {
> +                DEBUG(1, ("Group has multiple possible names, skipping\n"));
> +                continue;

You cannot just simply continue here, because in the typical case you
will end up with "Group ABC not present in LDAP" and return an error.
Otherwise there might be (broken) setups where there is also another group
with a single name so that it is also no good idea to just 'break' from
the inner loop.

Additionally I can still find a group with multiple names if I call
'getent group multi_name' directly and if it is in the cache it is also
returned by initgroups().

Another general problem I can see are primary groups with multiple
names.

bye,
Sumit



More information about the sssd-devel mailing list