[SSSD] SUDO Integration - in-memory cache
Pavel Březina
pbrezina at redhat.com
Thu Jan 26 15:35:04 UTC 2012
Dne 25.1.2012 20:50, Jakub Hrozek napsal(a):
> On Wed, Jan 25, 2012 at 08:44:40PM +0100, Jakub Hrozek wrote:
>> On Tue, Jan 24, 2012 at 03:10:32PM +0100, Pavel Březina wrote:
>>> https://fedorahosted.org/sssd/ticket/1111
>>>
>>> Requires cn=defaults patches.
>>>
>>> Please note, that the new sudo responder option (cache_timeout) will
>>> be added to SSSDConfig.py as a part of #1144.
>>
>> Nack,
>>
>> Please name the new option "sudo_cache_timeout" to avoid name-clash with
>> the general cache timeout. Cache timeouts are being separated in 1.8
>> anyway.
Done.
>> Nitpick: sudosrc_cache.c has the diacritics in your surname mangled.
I don't know how that happened, I hope that it is alright this time.
>> I would prefer to have a different prefix than res_ in struct
>> sudo_cache_entry. I realize that res is a common name used for
>> sysdb_attrs but that's largely used as a shorthand for "result". Simply
>> using "rules" and "num_rules" would be nicer.
Done.
>> The way FQDN-only domains are skipped is different from the
>> "cn=defaults" patch (and I prefer that approach). In this patch,
>> only the first domain is checked for being FQDN-only,
I'm sorry, I don't follow. Could you provide me some more information?
However, I've corrected a bug in sudosrv_cache_lookup() where I was
passing dctx->domain instead of domain as a parameter. It is fixed in
this patch.
I think it would
>> be better to move the check into the loop, or (and that probably better)
>> move the cache into sudosrv_get_rules().
Are you getting at this situation?
- We have domains A and B
- User x at B
- x at B calls 'sudo cmd' which stores rules for this user into sysdb and
into in-memory cache
- we create user x at A
- x at A uses sudo but it would use the rules for x at B until the in-memory
cache is expired
Your solution would certainly work for this situation but there wouldn't
be the need of in-memory cache anymore, we can use just sysdb.
The purpose of having in-memory cache is for the sudo request to be as
fast as possible. And I would like to point out that it is still just a
cache - and cache doesn't have to be necessary current.
>> Also please remove the FIXME from sudosrv_get_rules().
Thank you. I've also removed the other cache related FIXME, because I
believe it is sorted out this way. Please, correct me if I'm wrong.
> One more thing - the new option needs to be documented in man pages and
> settable by the configAPI.
Unfortunately it is not that simple. This affects the config tests as it
requires support of a new responder in the tests. It will be done in #1144.
Thank you for the review.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 0001-SUDO-Integration-in-memory-cache-in-responder.patch
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120126/8ce1652a/attachment.ksh>
More information about the sssd-devel
mailing list