|
 |
6cf099 |
From e10bcf99c6105b733b043a50ea96223a46784581 Mon Sep 17 00:00:00 2001
|
|
|
6cf099 |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
6cf099 |
Date: Tue, 21 Jul 2015 11:44:03 +0200
|
|
|
6cf099 |
Subject: [PATCH 37/37] IPA: Remove MPG groups if getgrgid was called before
|
|
|
6cf099 |
getpw()
|
|
|
6cf099 |
|
|
|
6cf099 |
https://fedorahosted.org/sssd/ticket/2724
|
|
|
6cf099 |
|
|
|
6cf099 |
This bug only affects IPA clients that are connected to IPA servers with
|
|
|
6cf099 |
AD trust and ID mapping in effect.
|
|
|
6cf099 |
|
|
|
6cf099 |
If an IPA client calls getgrgid() for an ID that matches a user, the
|
|
|
6cf099 |
user's private group would be returned and stored as a group entry.
|
|
|
6cf099 |
|
|
|
6cf099 |
Subsequent queries for that user would fail, because MPG domains impose
|
|
|
6cf099 |
uniqueness restriction for both the ID and name space across groups and
|
|
|
6cf099 |
users.
|
|
|
6cf099 |
|
|
|
6cf099 |
To work around that, we remove the UPG groups in MPG domains during a
|
|
|
6cf099 |
group lookup.
|
|
|
6cf099 |
|
|
|
6cf099 |
Reviewed-by: Sumit Bose <sbose@redhat.com>
|
|
|
6cf099 |
---
|
|
|
6cf099 |
src/providers/ipa/ipa_s2n_exop.c | 41 ++++++++++++++++++++++++++++++++++++++--
|
|
|
6cf099 |
1 file changed, 39 insertions(+), 2 deletions(-)
|
|
|
6cf099 |
|
|
|
6cf099 |
diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
6cf099 |
index 812a4bbd707faf5c184594b562c148d1e704fd58..1e6368dc7ef1a6f60b541409f7f6740d602f0d43 100644
|
|
|
6cf099 |
--- a/src/providers/ipa/ipa_s2n_exop.c
|
|
|
6cf099 |
+++ b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
6cf099 |
@@ -1764,6 +1764,7 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
|
|
|
6cf099 |
int tret;
|
|
|
6cf099 |
struct sysdb_attrs *gid_override_attrs = NULL;
|
|
|
6cf099 |
char ** exop_grouplist;
|
|
|
6cf099 |
+ struct ldb_message *msg;
|
|
|
6cf099 |
|
|
|
6cf099 |
tmp_ctx = talloc_new(NULL);
|
|
|
6cf099 |
if (tmp_ctx == NULL) {
|
|
|
6cf099 |
@@ -2005,8 +2006,44 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
|
|
|
6cf099 |
attrs->a.user.pw_dir, attrs->a.user.pw_shell,
|
|
|
6cf099 |
NULL, attrs->sysdb_attrs, NULL,
|
|
|
6cf099 |
timeout, now);
|
|
|
6cf099 |
- if (ret != EOK) {
|
|
|
6cf099 |
- DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_user failed.\n");
|
|
|
6cf099 |
+ if (ret == EEXIST && dom->mpg == true) {
|
|
|
6cf099 |
+ /* This handles the case where getgrgid() was called for
|
|
|
6cf099 |
+ * this user, so a group was created in the cache
|
|
|
6cf099 |
+ */
|
|
|
6cf099 |
+ ret = sysdb_search_group_by_name(tmp_ctx, dom, name, NULL, &msg;;
|
|
|
6cf099 |
+ if (ret != EOK) {
|
|
|
6cf099 |
+ /* Fail even on ENOENT, the group must be around */
|
|
|
6cf099 |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
6cf099 |
+ "Could not delete MPG group [%d]: %s\n",
|
|
|
6cf099 |
+ ret, sss_strerror(ret));
|
|
|
6cf099 |
+ goto done;
|
|
|
6cf099 |
+ }
|
|
|
6cf099 |
+
|
|
|
6cf099 |
+ ret = sysdb_delete_group(dom, NULL, attrs->a.user.pw_uid);
|
|
|
6cf099 |
+ if (ret != EOK) {
|
|
|
6cf099 |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
6cf099 |
+ "sysdb_delete_group failed for MPG group [%d]: %s\n",
|
|
|
6cf099 |
+ ret, sss_strerror(ret));
|
|
|
6cf099 |
+ goto done;
|
|
|
6cf099 |
+ }
|
|
|
6cf099 |
+
|
|
|
6cf099 |
+ ret = sysdb_store_user(dom, name, NULL,
|
|
|
6cf099 |
+ attrs->a.user.pw_uid,
|
|
|
6cf099 |
+ gid, attrs->a.user.pw_gecos,
|
|
|
6cf099 |
+ attrs->a.user.pw_dir,
|
|
|
6cf099 |
+ attrs->a.user.pw_shell,
|
|
|
6cf099 |
+ NULL, attrs->sysdb_attrs, NULL,
|
|
|
6cf099 |
+ timeout, now);
|
|
|
6cf099 |
+ if (ret != EOK) {
|
|
|
6cf099 |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
6cf099 |
+ "sysdb_store_user failed for MPG user [%d]: %s\n",
|
|
|
6cf099 |
+ ret, sss_strerror(ret));
|
|
|
6cf099 |
+ goto done;
|
|
|
6cf099 |
+ }
|
|
|
6cf099 |
+ } else if (ret != EOK) {
|
|
|
6cf099 |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
6cf099 |
+ "sysdb_store_user failed [%d]: %s\n",
|
|
|
6cf099 |
+ ret, sss_strerror(ret));
|
|
|
6cf099 |
goto done;
|
|
|
6cf099 |
}
|
|
|
6cf099 |
|
|
|
6cf099 |
--
|
|
|
6cf099 |
2.4.3
|
|
|
6cf099 |
|