[SSSD] [PATCH] Netgroups should ignore the 'use_fully_qualified_names' setting

Stephen Gallagher sgallagh at redhat.com
Mon Jul 22 18:23:52 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/15/2013 09:53 AM, Jakub Hrozek wrote:
> On Thu, Jul 11, 2013 at 10:08:36AM -0400, Stephen Gallagher wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>> 
>> Netgroups often have memberNisNetgroup entries included in them 
>> that will never process correctly if we require fully-qualified 
>> names on the nested lookup. This patch alters the behavior of 
>> netgroup lookups to check *all* domains for an unqualified 
>> netgroup name, instead of only the ones not requiring fully- 
>> qualified names.
>> 
>> Fixes https://fedorahosted.org/sssd/ticket/2013
> 
>> @@ -428,9 +428,12 @@ static errno_t lookup_netgr_step(struct
>> setent_step_ctx *step_ctx)
>> 
>> /* Check each domain for this netgroup name */ while (dom) { -
>> /* if it is a domainless search, skip domains that require fully 
>> -         * qualified names instead */ -        while (dom &&
>> step_ctx->check_next && dom->fqnames) { +        /* Netgroups are
>> a special case. We have to ignore the +         * fully-qualified
>> name requirement because memberNisNetgroup +         * entries do
>> not have fully-qualified components and we need +         * to be
>> able to always check them. +         */ +        while (dom &&
>> step_ctx->check_next) { dom = get_next_domain(dom, false); }
> 
> I don't think this is a correct change, the way I read the loop now
> is:
> 
> while(there is a domain and the search is domainless) { get next
> domain }
> 
> So essentially this just skips domains? I'm not able to call getent
> netgroup for a netgroup that resides in a second domain in my
> multidomain setup with this patch..

That's what I deserve for throwing together a simple patch just before
going on vacation...

Instead of removing the loop that skips over the fully-qualified
domains, I only removed the part of the loop control that prevented it
from skipping over non-fully-qualified ones. Thus, of course, it
skipped ALL domains.

The attached patch should get it right this time.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlHteLgACgkQeiVVYja6o6PEVgCdGqyM3bLF0Su8vZ8pM6ud2GrN
RKUAniAAa0GcSnZVDZoN9lMUIJ48EklY
=GWJD
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Netgroups-should-ignore-the-use_fully_qualified_name.patch
Type: text/x-patch
Size: 2923 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130722/4d1f576f/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Netgroups-should-ignore-the-use_fully_qualified_name.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130722/4d1f576f/attachment.sig>


More information about the sssd-devel mailing list