[SSSD] [PATCH] Netgroups should ignore the 'use_fully_qualified_names' setting
Jakub Hrozek
jhrozek at redhat.com
Mon Jul 15 13:53:20 UTC 2013
On Thu, Jul 11, 2013 at 10:08:36AM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Netgroups often have memberNisNetgroup entries included in them
> that will never process correctly if we require fully-qualified
> names on the nested lookup. This patch alters the behavior of
> netgroup lookups to check *all* domains for an unqualified
> netgroup name, instead of only the ones not requiring fully-
> qualified names.
>
> Fixes https://fedorahosted.org/sssd/ticket/2013
> @@ -428,9 +428,12 @@ static errno_t lookup_netgr_step(struct setent_step_ctx *step_ctx)
>
> /* Check each domain for this netgroup name */
> while (dom) {
> - /* if it is a domainless search, skip domains that require fully
> - * qualified names instead */
> - while (dom && step_ctx->check_next && dom->fqnames) {
> + /* Netgroups are a special case. We have to ignore the
> + * fully-qualified name requirement because memberNisNetgroup
> + * entries do not have fully-qualified components and we need
> + * to be able to always check them.
> + */
> + while (dom && step_ctx->check_next) {
> dom = get_next_domain(dom, false);
> }
I don't think this is a correct change, the way I read the loop now is:
while(there is a domain and the search is domainless) {
get next domain
}
So essentially this just skips domains? I'm not able to call getent netgroup
for a netgroup that resides in a second domain in my multidomain setup
with this patch..
More information about the sssd-devel
mailing list