[SSSD] [PATCH] Every time use permissive control in function memberof_mod.

Jakub Hrozek jhrozek at redhat.com
Wed Jul 17 12:18:57 UTC 2013


On Tue, Jul 16, 2013 at 03:01:31PM +0200, Lukas Slebodnik wrote:
> ehlo,
> 
> Group structure is described in ticket https://fedorahosted.org/sssd/ticket/1846
> Please ensure that sysdb cache is empty.
> 
> call command "getent group cyclegroup1"
> 
> sssd_be will call following function:
> a) sdap_store_group_with_gid (name:cyclegroup1)
>    --added attributes [ ghost: user1, origMember: user1, ... ]
> b) sdap_store_group_with_gid (name:cyclegroup2)
>    --added attributes [ ghost: user2, origMember: user2, ... ]
> c) sdap_save_grpmem (name:cyclegroup1)
>    --added attributes [ member:cyclegroup2, ... ]
> d) sdap_save_grpmem (name:cyclegroup2)
>    --added attributes [ member:cyclegroup1, ... ]
> 
> Subtransaction "d)"  will fail and log file contains:
> [ldb] (0x4000): will add 2 ghost users to 1 parents
> ... snip ...
> [ldb] (0x4000): cancel ldb transaction (nesting: 2)
> [sysdb_set_entry_attr] (0x0080): ldb_modify failed: [Attribute or value exists]
> [sysdb_set_entry_attr] (0x0400): Error: 17 (File exists)
> [sysdb_store_group] (0x0400): Error: 17 (File exists)
> [sdap_save_grpmem] (0x0040): Failed to save user cyclegroup2
> [sdap_save_groups] (0x0040): Failed to store group 1 members.
> [ldb] (0x4000): commit ldb transaction (nesting: 1)
> [ldb] (0x4000): commit ldb transaction (nesting: 0)
> 
> Attached patch should fix this bug.
> 
> LS

I personally don't have a problem with the patch. It *might* hide
legitimate bugs but on the other hand the call was issued so that the
attribute is added and if it was added already during processing of a
cycle, then fine.

But the memberof plugin is delicate code, so I would also like to get
Simo's opinion. Simo, are you OK with this approach or would you prefer
do detect the cycle instead?

Please note that the function that Lukas added the permissive control to
is called to distribute both ghost and memberuid attributes.

> From d266b1c412731d6cbca18228a32f48017efbf3aa Mon Sep 17 00:00:00 2001
> From: Lukas Slebodnik <lslebodn at redhat.com>
> Date: Mon, 15 Jul 2013 11:00:04 +0200
> Subject: [PATCH] Every time use permissive control in function memberof_mod.
> 
> Storing cyclic groups into sysdb can cause adding ghost members,
> which has already been stored. Function ldb_modify will fail
> with error [Attribute or value exists].
> 
> With permisive control, duplicated attributes will be skipped
> as if it was never added.
> 
> https://fedorahosted.org/sssd/ticket/1846
> ---
>  src/ldb_modules/memberof.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/src/ldb_modules/memberof.c b/src/ldb_modules/memberof.c
> index 4a9328482b1d3999ea0f57051249dfe5415b995f..79b33137b5ac45bda4bb5fc7efce4553f7227fe3 100644
> --- a/src/ldb_modules/memberof.c
> +++ b/src/ldb_modules/memberof.c
> @@ -1135,6 +1135,13 @@ static int mbof_add_muop(struct mbof_add_ctx *add_ctx)
>          return ret;
>      }
>  
> +    ret = ldb_request_add_control(mod_req, LDB_CONTROL_PERMISSIVE_MODIFY_OID,
> +                                  false, NULL);
> +    if (ret != LDB_SUCCESS) {
> +        talloc_free(mod_req);
> +        return ret;
> +    }
> +
>      return ldb_next_request(ctx->module, mod_req);
>  }
>  
> -- 
> 1.8.3.1
> 

> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list