[SSSD] [PATCH] add pysss.getgrouplist(username)

Alexander Bokovoy abokovoy at redhat.com
Mon Jul 22 13:17:30 UTC 2013


On Mon, 22 Jul 2013, Jakub Hrozek wrote:
>On Fri, Jul 19, 2013 at 07:15:34PM +0300, Alexander Bokovoy wrote:
>> On Fri, 19 Jul 2013, Jakub Hrozek wrote:
>> >On Fri, Jul 19, 2013 at 04:29:37PM +0300, Alexander Bokovoy wrote:
>> >>Hi!
>> >>
>> >>Apparently, getgrouplist(3) call is not available in Python older than
>> >>Python 3.3. So I agreed with Jakub to have it bound to pysss Python
>> >>module. We need this call to obtain list of groups trusted domain user
>> >>belongs to for HBAC testing in FreeIPA.
>> >>
>> >>Additionally, I've fixed bug with linking of pysss. This patch is
>> >>relevant to 1.10 as well, while the first one is needed in sssd 1.11.
>> >>
>> >>
>> >>--
>> >>/ Alexander Bokovoy
>> >
>> >>Subject: [PATCH 1/2] build: fix dependencies for pysss module
>> >Ack
>> >
>> >>Subject: [PATCH 2/2] pysss: add pysss.getgrouplist(username)
>> >
>> >I would just like to amend the doctext to make it clear that this is
>> >just a system wrapper and not limited to users served by the sssd. See
>> >the attached patch, I'd like to squash it before pushing.
>>
>> >From a4b19b4b0e5d1e9b088059fc77f01e07d2407ca0 Mon Sep 17 00:00:00 2001
>> >From: Jakub Hrozek <jhrozek at redhat.com>
>> >Date: Fri, 19 Jul 2013 16:52:11 +0200
>> >Subject: [PATCH] Amend the doctext
>> >
>> >---
>> >src/python/pysss.c | 2 ++
>> >1 file changed, 2 insertions(+)
>> >
>> >diff --git a/src/python/pysss.c b/src/python/pysss.c
>> >index a2924ff32575e1d41a776769720129b42de860da..6ae9a25268e632817311ff3cf0cb9354d99b5be3 100644
>> >--- a/src/python/pysss.c
>> >+++ b/src/python/pysss.c
>> >@@ -751,6 +751,8 @@ fail:
>> > */
>> >PyDoc_STRVAR(py_sss_getgrouplist__doc__,
>> >    "Get list of groups user belongs to.\n\n"
>> >+    "NOTE: The interface uses the system NSS calls and is not limited to "
>> >+    "users served by the SSSD!\n"
>> >    ":param username: name of user to get list for\n");
>> >
>> >static PyObject *py_sss_getgrouplist(PyObject *self, PyObject *args)
>> ACK.
>>
>
>Squashed in the doctext fix and pushed to master. The first patch was
>also pushed to sssd-1-10.
You were too fast but I have another fix for the unlikely case of NSS
modules returning group IDs that cannot be resolved back. In such case
these group IDs need to be skipped and, as result, whole tuple needs to
be resized.

>After a discussion on IRC with Tomas and Alexander, we found one bug in
>IPA. I'm also checking the recent idmap changes to see if we're behaving
>correctly.
Yes, Tomas did send updated patch to FreeIPA list that fixed the issue.

-- 
/ Alexander Bokovoy
-------------- next part --------------
>From 81171c21683af6be007efd5576fda264d2afe12d Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy at redhat.com>
Date: Mon, 22 Jul 2013 16:03:39 +0300
Subject: [PATCH] pysss: prevent crashing when group is unresolvable

In unlikely case that an NSS module returns a reference to a group
and we are unable to resolve it shortly after that, make sure these
groups are skipped.
---
 src/python/pysss.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/python/pysss.c b/src/python/pysss.c
index 6ae9a25..4dd0351 100644
--- a/src/python/pysss.c
+++ b/src/python/pysss.c
@@ -763,7 +763,7 @@ static PyObject *py_sss_getgrouplist(PyObject *self, PyObject *args)
     struct group *gr;
     int ngroups;
     int ret;
-    Py_ssize_t i;
+    Py_ssize_t i, idx;
     PyObject *groups_tuple;
 
     if(!PyArg_ParseTuple(args, discard_const_p(char, "s"), &username)) {
@@ -793,9 +793,20 @@ static PyObject *py_sss_getgrouplist(PyObject *self, PyObject *args)
         goto fail;
     }
 
+    /* Populate a tuple with names of groups
+     * In unlikely case of group not being able to resolve, skip it
+     * We also need to resize resulting tuple to avoid empty elements there */
+    idx = 0;
     for (i = 0; i < ngroups; i++) {
         gr = getgrgid(groups[i]);
-        PyTuple_SetItem(groups_tuple, i, PyString_FromString(gr->gr_name));
+        if (gr) {
+            PyTuple_SetItem(groups_tuple, idx, PyString_FromString(gr->gr_name));
+            idx++;
+        }
+    }
+
+    if (i != idx) {
+        _PyTuple_Resize(&groups_tuple, idx);
     }
 
     return groups_tuple;
-- 
1.8.3.1



More information about the sssd-devel mailing list