[SSSD] [PATCHES] Do not call sss_cmd_done in function check_cache

Jakub Hrozek jhrozek at redhat.com
Tue Jun 25 13:16:16 UTC 2013


On Tue, Jun 25, 2013 at 10:36:14AM +0200, Lukas Slebodnik wrote:
> ehlo,
> 
> Attached patches should fix https://fedorahosted.org/sssd/ticket/1980
> 
> The first patch adds check after sysdb_getnetgr. If sysdb_getnetgr returns more
> result than 1, sssd will return error. sysdb_getpwnam has already had
> this check.
> 
> The second patch removes function call sss_cmd_done inside of check_cache,
> because function is sss_cmd_done is called in parent functions.
> This was a reason of sssd crash.
> 
> How to reproduce this crash.
> 1.Add Netgroup to sysdb cache with base cn=Netgroups,cn=<domain>,cn=sysdb
>   This netgroup should have the same attribute (name or nameAlias or memberOf)
>   as another netgroup.
> 2. call sudo with user, which is member of ^^^ netgroup.
> 
> Those patches fix only sssd crash, but we should find out:
>   Why were those netgroups stored in sysdb.
> 
> LS

> From 5877db33fc0d52cf31f8b052a8a10ed16a307b0c Mon Sep 17 00:00:00 2001
> From: Lukas Slebodnik <lslebodn at redhat.com>
> Date: Tue, 25 Jun 2013 09:01:45 +0200
> Subject: [PATCH 1/2] Handle too many results from getnetgr.
> 
> ---
>  src/responder/nss/nsssrv_netgroup.c | 14 +++++++++++++-
>  1 file changed, 13 insertions(+), 1 deletion(-)
> 
> diff --git a/src/responder/nss/nsssrv_netgroup.c b/src/responder/nss/nsssrv_netgroup.c
> index 4ec4161cf9c043792fffede1aa95acaf929a7071..12be52bf832cc5315f29b8faac22d4b6c44b3b22 100644
> --- a/src/responder/nss/nsssrv_netgroup.c
> +++ b/src/responder/nss/nsssrv_netgroup.c
> @@ -363,7 +363,14 @@ static errno_t setnetgrent_retry(struct tevent_req *req)
>          }
>  
>          ret = lookup_netgr_step(step_ctx);
> -        if (ret != EOK) {
> +        switch (ret) {
> +        case EOK:
> +            break;
> +        case EMSGSIZE:
> +            state->netgr->ready = true;

Do we need to set the entry to hash? Can't we just shortcut to
tevent_req_error ?

> +            ret = ENOENT;
> +            /* FALLTHROUGH */
> +        default:
>              goto done;
>          }
>          tevent_req_done(req);

[PATCH 2/2] Do not call sss_cmd_done in function check_cache.
Ack
I'm glad there is one less FIXME in the code base.



More information about the sssd-devel mailing list