[SSSD] [PATCH] Two minor enhancements on using the negative cache in the PAM responder

Jakub Hrozek jhrozek at redhat.com
Wed Aug 7 10:04:46 UTC 2013


Hi,

Yassir who was going through the PAM code recently pointed out two
strange issues with the PAM responder's usage of negative cache. Please
see the attached patches for more details, but simplified version is:

 1) The negative cache was only ever checked for domainless searches
 2) The negative cache was only checked, never set

I don't think this is a pressing issue because in most occasions, the
negative cache would be hit by the application calling getpwnam() and so
the PAM responder would not be called at all, but I think the code
should at least be consistent.

The alternative is of course to stop using negative cache in the PAM
respnder completely, but I think it has some benefit if the application
would only call the PAM conversation.
-------------- next part --------------
>From 1d9a407e0779cfbc30ea5e60b2f5543c360362c7 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 7 Aug 2013 11:25:20 +0200
Subject: [PATCH 1/2] PAM: Check negcache when searching for fully qualified
 users, too

---
 src/responder/pam/pamsrv_cmd.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index 4e3bd79c1f514fd9600ca360a7a205b7d4888e5f..645f9357b7c6fd70755930cfd3fde0c8b23419ca 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -806,6 +806,14 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
             ret = ENOENT;
             goto done;
         }
+
+        ncret = sss_ncache_check_user(pctx->ncache, pctx->neg_timeout,
+                                      preq->domain, pd->user);
+        if (ncret == EEXIST) {
+            /* User found in the negative cache */
+            ret = ENOENT;
+            goto done;
+        }
     } else {
         for (dom = preq->cctx->rctx->domains;
              dom;
-- 
1.8.3.1

-------------- next part --------------
>From f4aa833f42546a870cfd2f8191711d72c235e08a Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 7 Aug 2013 11:25:50 +0200
Subject: [PATCH 2/2] PAM: Set negcache if user is not found after provider
 check

---
 src/responder/pam/pamsrv_cmd.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index 645f9357b7c6fd70755930cfd3fde0c8b23419ca..ed3afb63a2d12f9763d5865e94b2c75c369722f4 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -975,6 +975,16 @@ static int pam_check_user_search(struct pam_auth_req *preq)
         }
 
         if (preq->res->count == 0) {
+            if (preq->check_provider == false) {
+                /* set negative cache only if not result of cache check */
+                ret = sss_ncache_set_user(pctx->ncache, false, dom, name);
+                if (ret != EOK) {
+                    /* Should not be fatal, just slower next time */
+                    DEBUG(SSSDBG_MINOR_FAILURE,
+                           ("Cannot set ncache for %s\n", name, dom));
+                }
+            }
+
             /* if a multidomain search, try with next */
             if (!preq->pd->domain) {
                 dom = get_next_domain(dom, false);
-- 
1.8.3.1



More information about the sssd-devel mailing list