[SSSD] How to map primaryGID?

Stephen Gallagher sgallagh at redhat.com
Sun Apr 22 19:43:16 UTC 2012


On Sun, 2012-04-22 at 15:10 -0400, Stephen Gallagher wrote:
> Ok, I just hit a snag and I'm not sure how best to proceed. All users on
> a POSIX system need to have a default GID value, which in most cases is
> mapped to a user-private group to help avoid accidental permission-leaks
> when that user creates files.
> 
> However, when mapping a user from Active Directory's objectSID, we don't
> have an obvious group to which we can map the primaryGID. I'm not sure
> how best to proceed here.
> 
> One option is to map users' primaryGID to the special group "Domain
> Users" to which all AD users belong, but that runs the risk of
> reintroducing the above-mentioned permission leaks. I don't really have
> any other ideas here, though. Recommendations welcome.


I've got another set of (less) preliminary patches available now. I've
broken the patches up a bit more, so each one is easier to review on its
own. I dropped the useless SAFEALIGN macros as Simo suggested. I also
implemented a compatibility mode that will behave the same way that
autorid does (with one default domain and all other domains assigned a
slot as first-come, first-served).

These patches are more or less functionally complete now (excepting the
primaryGID question above), but they are still lacking in documentation
and options added to the SSSDConfig API. That will follow in the final
version.

Patch 0001: Add objectSID config option

Patch 0002: Helper function to convert AD's binary blob to a 'struct
dom_sid'. This has moved since the previous patch set to ldap_common.c
so it can be used by both user and group calls.

Patch 0003: Helper function to convert a 'struct dom_sid' to the string
representation. This has moved since the previous patch set to
ldap_common.c so it can be used by both user and group calls. It still
retains the 64-bit limitation discussed in the earlier email. So far
I've seen no great benefit to extending it to the full 96-bits (doesn't
seem to be used).

Patch 0004: Add a boolean option to enable ID mapping

Patch 0005: Add some new sysdb routines to manage saving ID mappings in
the cache so that they will persist between restarts of SSSD.

Patch 0006: Add helper routines to the LDAP provider to handle adding
domains and initializing the maps at startup. This function implements
the murmurhash3-based autorid implementation.

Patch 0007: Add options to configure the ranges. As Simo requested, this
sets up 10,000 slices of up to 200,000 IDs by default.

Patch 0008: Initialize the sdap_idmap when ID-mapping is enabled.

Patch 0009: Look up users with ID-mapping. This handles both getpwnam()
and initgroups, since it's done at the sdap_save_user() routine.

Patch 0010: As Jakub requested, this patch adds an autorid compatibility
mode which guarantees that all domains start at zero and increment up.

Patch 0011: This patch extends the previous patch, allowing the
configuration of a single default domain that will be guaranteed to be
slice 0. This option will need careful documentation when I get to it,
because it only has any meaning on the first startup from a clean cache.
Changing it without purging the cache will have no effect (for
consistency reasons).

Patch 0012: Helper routine to extract the domain SID from a user or
group objectSID.

Patch 0013: This routine will automatically allocate a slice for a
domain if it has not been seen before, assigning it a temporary name
that matches the domain SID.

Patch 0014: Add support for getpwuid() requests. There's a catch here.
We can only look up UIDs for domains that we have a mapping for already.
This means that the ID has to either be in the default domain (if one is
configured), or at least one user from this domain must have been looked
up by name beforehand. In practice, this should not be a real
limitation, since a user login will always establish the domain mapping.

Patch 0015: Similar to patch 0009, but for groups.

Patch 0016: Similar to patch 0014, but for groups.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-LDAP-Add-objectSID-config-option-Needs-manpage.patch
Type: text/x-patch
Size: 8224 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-LDAP-Add-function-to-convert-binary-LDAP-blob-to-a-d.patch
Type: text/x-patch
Size: 3278 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-LDAP-Add-function-to-convert-a-dom_sid-to-its-string.patch
Type: text/x-patch
Size: 4613 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0002.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0004-LDAP-Add-id-mapping-option-needs-manpage.patch
Type: text/x-patch
Size: 4738 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0003.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0005-Add-sysdb-routines-for-ID-mapping.patch
Type: text/x-patch
Size: 12823 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0004.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0006-LDAP-Add-helper-routines-for-ID-mapping.patch
Type: text/x-patch
Size: 13178 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0005.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0007-LDAP-Add-ID-mapping-range-settings-Needs-Manpage.patch
Type: text/x-patch
Size: 2581 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0006.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0008-LDAP-Initialize-ID-mapping-when-configured.patch
Type: text/x-patch
Size: 1898 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0007.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0009-LDAP-Enable-looking-up-ID-mapped-users-by-name.patch
Type: text/x-patch
Size: 4880 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0008.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0010-LDAP-Add-autorid-compatibility-mode-Needs-Manpage.patch
Type: text/x-patch
Size: 3891 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0009.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0011-LDAP-Allow-setting-a-default-domain-for-id-mapping-s.patch
Type: text/x-patch
Size: 4773 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0010.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0012-LDAP-Add-routine-to-extract-domain-SID-from-an-objec.patch
Type: text/x-patch
Size: 3709 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0011.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0013-LDAP-Allow-automatically-provisioning-a-domain-and-r.patch
Type: text/x-patch
Size: 3862 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0012.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0014-LDAP-Enable-looking-up-id-mapped-users-by-UID.patch
Type: text/x-patch
Size: 3419 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0013.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0015-LDAP-Allow-looking-up-ID-mapped-groups-by-name.patch
Type: text/x-patch
Size: 6306 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0014.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0016-LDAP-Enable-looking-up-id-mapped-groups-by-GID.patch
Type: text/x-patch
Size: 3185 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment-0015.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120422/fe366a3d/attachment.sig>


More information about the sssd-devel mailing list