[SSSD] [PATCH] Netgroups should ignore the 'use_fully_qualified_names' setting

Jakub Hrozek jhrozek at redhat.com
Mon Jul 15 13:53:20 UTC 2013


On Thu, Jul 11, 2013 at 10:08:36AM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Netgroups often have memberNisNetgroup entries included in them
> that will never process correctly if we require fully-qualified
> names on the nested lookup. This patch alters the behavior of
> netgroup lookups to check *all* domains for an unqualified
> netgroup name, instead of only the ones not requiring fully-
> qualified names.
> 
> Fixes https://fedorahosted.org/sssd/ticket/2013

> @@ -428,9 +428,12 @@ static errno_t lookup_netgr_step(struct setent_step_ctx *step_ctx)
>  
>      /* Check each domain for this netgroup name */
>      while (dom) {
> -        /* if it is a domainless search, skip domains that require fully
> -         * qualified names instead */
> -        while (dom && step_ctx->check_next && dom->fqnames) {
> +        /* Netgroups are a special case. We have to ignore the
> +         * fully-qualified name requirement because memberNisNetgroup
> +         * entries do not have fully-qualified components and we need
> +         * to be able to always check them.
> +         */
> +        while (dom && step_ctx->check_next) {
>              dom = get_next_domain(dom, false);
>          }

I don't think this is a correct change, the way I read the loop now is:

while(there is a domain and the search is domainless) {
 get next domain
}

So essentially this just skips domains? I'm not able to call getent netgroup
for a netgroup that resides in a second domain in my multidomain setup
with this patch..



More information about the sssd-devel mailing list