[SSSD] [PATCH] Fix faulty usn reinit

Simo Sorce simo at redhat.com
Sun Jan 6 05:37:30 UTC 2013


While looking at some code my eye fell on the fact that sdap_reinit.c
was including sysdb_private.h

That's a no-no on its own, you don't get to use private headers
liberally, or I wouldn't have marked them "private" in the first place!

However besides the abuse of the private headers I found also that the
function was broken because it wasn't doing what it was trying to do
(limit cleanups to users, groups and services).

Instead it would search the whole tree (3 times) and later remove all
entries w/o a USN.

I think this could cause the code to remove *everything* not directly
downloaded from the IPA tree (for example subdomain users) that lacks
the SYSDB_USN attribute for example.

I haven't tested the patch yet tbh, but I do not have the setup right
now, if someone has a 2 servers setup ready and can force sssd to
reconnect to the second and step through the cleanup to make sure it
runs as it should I would be grateful.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Fix-sdap-reinit.patch
Type: text/x-patch
Size: 10756 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130106/9eb036ce/attachment.bin>


More information about the sssd-devel mailing list