[SSSD] [PATCH] Netgroups should ignore the 'use_fully_qualified_names' setting
Stephen Gallagher
sgallagh at redhat.com
Mon Jul 22 18:23:52 UTC 2013
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/15/2013 09:53 AM, Jakub Hrozek wrote:
> On Thu, Jul 11, 2013 at 10:08:36AM -0400, Stephen Gallagher wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>
>> Netgroups often have memberNisNetgroup entries included in them
>> that will never process correctly if we require fully-qualified
>> names on the nested lookup. This patch alters the behavior of
>> netgroup lookups to check *all* domains for an unqualified
>> netgroup name, instead of only the ones not requiring fully-
>> qualified names.
>>
>> Fixes https://fedorahosted.org/sssd/ticket/2013
>
>> @@ -428,9 +428,12 @@ static errno_t lookup_netgr_step(struct
>> setent_step_ctx *step_ctx)
>>
>> /* Check each domain for this netgroup name */ while (dom) { -
>> /* if it is a domainless search, skip domains that require fully
>> - * qualified names instead */ - while (dom &&
>> step_ctx->check_next && dom->fqnames) { + /* Netgroups are
>> a special case. We have to ignore the + * fully-qualified
>> name requirement because memberNisNetgroup + * entries do
>> not have fully-qualified components and we need + * to be
>> able to always check them. + */ + while (dom &&
>> step_ctx->check_next) { dom = get_next_domain(dom, false); }
>
> I don't think this is a correct change, the way I read the loop now
> is:
>
> while(there is a domain and the search is domainless) { get next
> domain }
>
> So essentially this just skips domains? I'm not able to call getent
> netgroup for a netgroup that resides in a second domain in my
> multidomain setup with this patch..
That's what I deserve for throwing together a simple patch just before
going on vacation...
Instead of removing the loop that skips over the fully-qualified
domains, I only removed the part of the loop control that prevented it
from skipping over non-fully-qualified ones. Thus, of course, it
skipped ALL domains.
The attached patch should get it right this time.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlHteLgACgkQeiVVYja6o6PEVgCdGqyM3bLF0Su8vZ8pM6ud2GrN
RKUAniAAa0GcSnZVDZoN9lMUIJ48EklY
=GWJD
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Netgroups-should-ignore-the-use_fully_qualified_name.patch
Type: text/x-patch
Size: 2923 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130722/4d1f576f/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Netgroups-should-ignore-the-use_fully_qualified_name.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130722/4d1f576f/attachment.sig>
More information about the sssd-devel
mailing list