[SSSD] [PATCH] name2sid: Check negative cache for users and groups

Sumit Bose sbose at redhat.com
Fri Sep 5 15:54:59 UTC 2014


Hi,

I found this while testing other stuff.

bye,
Sumit
-------------- next part --------------
From d2fbe17663f7cfc79e11e2fec7371f102bbe9aed Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 4 Sep 2014 15:42:26 +0200
Subject: [PATCH] name2sid: Check negative cache for users and groups

Since we cannot know if a SID belongs to a user or a group a lookup
should only fail if the given name is in both the negative cache for the
users and the groups.

Currently if the SID for a group called 'abc' should be looked up and
the negative cache for the users contain an entry for 'abc' the request
fails.
---
 src/responder/nss/nsssrv_cmd.c | 34 +++++++++++++++++++---------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index bf578f3..c51ad13 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -4075,26 +4075,30 @@ static errno_t nss_cmd_getsidby_search(struct nss_dom_ctx *dctx)
             }
 
 
-            /* verify this user has not yet been negatively cached,
-            * or has been permanently filtered */
+            /* verify this name has not yet been negatively cached, as user
+             * and groupm, or has been permanently filtered */
             ret = sss_ncache_check_user(nctx->ncache, nctx->neg_timeout,
                                         dom, name);
 
-            /* if neg cached, return we didn't find it */
             if (ret == EEXIST) {
-                DEBUG(SSSDBG_TRACE_FUNC,
-                      "User [%s] does not exist in [%s]! (negative cache)\n",
-                       name, dom->name);
-                /* if a multidomain search, try with next */
-                if (cmdctx->check_next) {
-                    dom = get_next_domain(dom, false);
-                    continue;
+                ret = sss_ncache_check_group(nctx->ncache, nctx->neg_timeout,
+                                             dom, name);
+                if (ret == EEXIST) {
+                    /* if neg cached, return we didn't find it */
+                    DEBUG(SSSDBG_TRACE_FUNC,
+                          "User [%s] does not exist in [%s]! (negative cache)\n",
+                           name, dom->name);
+                    /* if a multidomain search, try with next */
+                    if (cmdctx->check_next) {
+                        dom = get_next_domain(dom, false);
+                        continue;
+                    }
+                    /* There are no further domains or this was a
+                     * fully-qualified user request.
+                     */
+                    ret = ENOENT;
+                    goto done;
                 }
-                /* There are no further domains or this was a
-                 * fully-qualified user request.
-                 */
-                ret = ENOENT;
-                goto done;
             }
 
             DEBUG(SSSDBG_TRACE_FUNC, "Requesting info for [%s@%s]\n",
-- 
1.8.3.1



More information about the sssd-devel mailing list