[SSSD] [PATCH] Every time use permissive control in function memberof_mod.

Jakub Hrozek jhrozek at redhat.com
Wed Jul 17 12:59:21 UTC 2013


On Wed, Jul 17, 2013 at 02:40:45PM +0200, Jakub Hrozek wrote:
> On Wed, Jul 17, 2013 at 08:23:57AM -0400, Simo Sorce wrote:
> > On Wed, 2013-07-17 at 14:18 +0200, Jakub Hrozek wrote:
> > > On Tue, Jul 16, 2013 at 03:01:31PM +0200, Lukas Slebodnik wrote:
> > > > ehlo,
> > > > 
> > > > Group structure is described in ticket https://fedorahosted.org/sssd/ticket/1846
> > > > Please ensure that sysdb cache is empty.
> > > > 
> > > > call command "getent group cyclegroup1"
> > > > 
> > > > sssd_be will call following function:
> > > > a) sdap_store_group_with_gid (name:cyclegroup1)
> > > >    --added attributes [ ghost: user1, origMember: user1, ... ]
> > > > b) sdap_store_group_with_gid (name:cyclegroup2)
> > > >    --added attributes [ ghost: user2, origMember: user2, ... ]
> > > > c) sdap_save_grpmem (name:cyclegroup1)
> > > >    --added attributes [ member:cyclegroup2, ... ]
> > > > d) sdap_save_grpmem (name:cyclegroup2)
> > > >    --added attributes [ member:cyclegroup1, ... ]
> > > > 
> > > > Subtransaction "d)"  will fail and log file contains:
> > > > [ldb] (0x4000): will add 2 ghost users to 1 parents
> > > > ... snip ...
> > > > [ldb] (0x4000): cancel ldb transaction (nesting: 2)
> > > > [sysdb_set_entry_attr] (0x0080): ldb_modify failed: [Attribute or value exists]
> > > > [sysdb_set_entry_attr] (0x0400): Error: 17 (File exists)
> > > > [sysdb_store_group] (0x0400): Error: 17 (File exists)
> > > > [sdap_save_grpmem] (0x0040): Failed to save user cyclegroup2
> > > > [sdap_save_groups] (0x0040): Failed to store group 1 members.
> > > > [ldb] (0x4000): commit ldb transaction (nesting: 1)
> > > > [ldb] (0x4000): commit ldb transaction (nesting: 0)
> > > > 
> > > > Attached patch should fix this bug.
> > > > 
> > > > LS
> > > 
> > > I personally don't have a problem with the patch. It *might* hide
> > > legitimate bugs but on the other hand the call was issued so that the
> > > attribute is added and if it was added already during processing of a
> > > cycle, then fine.
> > > 
> > > But the memberof plugin is delicate code, so I would also like to get
> > > Simo's opinion. Simo, are you OK with this approach or would you prefer
> > > do detect the cycle instead?
> > 
> > Ideally we would detect, but using the permissive control is ok for now.
> 
> OK. Ack to Lukas's patch, then. Thanks for the second look!

Pushed to master, sssd-1-10 and sssd-1-9 (this bug was originally
reported against RHEL-6)



More information about the sssd-devel mailing list