From b08906169216fdec43008c38891145386017d12f Mon Sep 17 00:00:00 2001

From: Alexey Tikhonov <atikhono@redhat.com>

Date: Fri, 22 Mar 2019 16:06:49 +0100

Subject: [PATCH 12/15] responder/negcache: avoid calling nsswitch NSS API

Changed "negcache_files.c::is_*_local_by_*()" to use functions from

"libnss_files" directly to check users (instead of calling glibc

NSS API).

Changed affected tests to avoid using NSS-wrapper and to use real

local user&group (otherwise tests were broken).

Resolves: https://pagure.io/SSSD/sssd/issue/3964

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

(cherry picked from commit 2b564f849a20289a857cf19bbfaa5c6eb8670bad)

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

---

 Makefile.am                           |  20 +++

 src/responder/common/negcache.c       |  52 +++++-

 src/responder/common/negcache_files.c |  74 ++++-----

 src/responder/common/negcache_files.h |  12 +-

 src/tests/cwrap/Makefile.am           |   4 +

 src/tests/cwrap/test_negcache.c       | 227 +++++++++++++++++++-------

 src/tests/intg/test_ldap.py           | 114 ++++++-------

 7 files changed, 333 insertions(+), 170 deletions(-)

diff --git a/Makefile.am b/Makefile.am

index 05f5f4e26..6a67dc7b1 100644

--- a/Makefile.am

+++ b/Makefile.am

@@ -569,6 +569,7 @@ SSSD_RESPONDER_IFACE_OBJ = \

 SSSD_RESPONDER_OBJ = \

     src/responder/common/negcache_files.c \

     src/responder/common/negcache.c \

+    src/util/nss_dl_load.c \

     src/responder/common/responder_cmd.c \

     src/responder/common/responder_common.c \

     src/responder/common/responder_dp.c \

@@ -1380,6 +1381,7 @@ sssd_nss_SOURCES = \

     src/responder/nss/nsssrv_mmap_cache.c \

     $(SSSD_RESPONDER_OBJ)

 sssd_nss_LDADD = \

+    $(LIBADD_DL) \

     $(TDB_LIBS) \

     $(SSSD_LIBS) \

     libsss_idmap.la \

@@ -1396,6 +1398,7 @@ sssd_pam_SOURCES = \

     src/responder/pam/pam_helpers.c \

     $(SSSD_RESPONDER_OBJ)

 sssd_pam_LDADD = \

+    $(LIBADD_DL) \

     $(TDB_LIBS) \

     $(SSSD_LIBS) \

     $(SELINUX_LIBS) \

@@ -1414,6 +1417,7 @@ sssd_sudo_SOURCES = \

     src/responder/sudo/sudosrv_dp.c \

     $(SSSD_RESPONDER_OBJ)

 sssd_sudo_LDADD = \

+    $(LIBADD_DL) \

     $(SSSD_LIBS) \

     $(SYSTEMD_DAEMON_LIBS) \

     $(SSSD_INTERNAL_LTLIBS)

@@ -1426,6 +1430,7 @@ sssd_autofs_SOURCES = \

     src/responder/autofs/autofssrv_dp.c \

     $(SSSD_RESPONDER_OBJ)

 sssd_autofs_LDADD = \

+    $(LIBADD_DL) \

     $(SSSD_LIBS) \

     $(SYSTEMD_DAEMON_LIBS) \

     $(SSSD_INTERNAL_LTLIBS)

@@ -1441,6 +1446,7 @@ sssd_ssh_SOURCES = \

     $(SSSD_RESPONDER_OBJ) \

     $(NULL)

 sssd_ssh_LDADD = \

+    $(LIBADD_DL) \

     $(SSSD_LIBS) \

     $(SSSD_INTERNAL_LTLIBS) \

     $(SYSTEMD_DAEMON_LIBS) \

@@ -1457,6 +1463,7 @@ sssd_pac_CFLAGS = \

     $(AM_CFLAGS) \

     $(NDR_KRB5PAC_CFLAGS)

 sssd_pac_LDADD = \

+    $(LIBADD_DL) \

     $(NDR_KRB5PAC_LIBS) \

     $(TDB_LIBS) \

     $(SSSD_LIBS) \

@@ -1481,6 +1488,7 @@ sssd_ifp_SOURCES = \

 sssd_ifp_CFLAGS = \

     $(AM_CFLAGS)

 sssd_ifp_LDADD = \

+    $(LIBADD_DL) \

     $(SSSD_LIBS) \

     $(SYSTEMD_DAEMON_LIBS) \

     $(SSSD_INTERNAL_LTLIBS) \

@@ -1525,6 +1533,7 @@ sssd_secrets_SOURCES = \

     $(SSSD_RESPONDER_OBJ) \

     $(NULL)

 sssd_secrets_LDADD = \

+    $(LIBADD_DL) \

     $(HTTP_PARSER_LIBS) \

     $(JANSSON_LIBS) \

     $(TDB_LIBS) \

@@ -1559,6 +1568,7 @@ sssd_kcm_CFLAGS = \

     $(JANSSON_CFLAGS) \

     $(NULL)

 sssd_kcm_LDADD = \

+    $(LIBADD_DL) \

     $(KRB5_LIBS) \

     $(CURL_LIBS) \

     $(JANSSON_LIBS) \

@@ -2254,6 +2264,7 @@ responder_socket_access_tests_SOURCES = \

     src/tests/responder_socket_access-tests.c \

     src/responder/common/negcache_files.c \

     src/responder/common/negcache.c \

+    src/util/nss_dl_load.c \

     src/responder/common/responder_common.c \

     src/responder/common/responder_packet.c \

     src/responder/common/responder_cmd.c \

@@ -2267,6 +2278,7 @@ responder_socket_access_tests_CFLAGS = \

     $(AM_CFLAGS) \

     $(CHECK_CFLAGS)

 responder_socket_access_tests_LDADD = \

+    $(LIBADD_DL) \

     $(CHECK_LIBS) \

     $(SSSD_LIBS) \

     $(SSSD_INTERNAL_LTLIBS) \

@@ -2358,6 +2370,7 @@ TEST_MOCK_RESP_OBJ = \

      src/responder/common/responder_cmd.c \

      src/responder/common/negcache_files.c \

      src/responder/common/negcache.c \

+     src/util/nss_dl_load.c \

      src/responder/common/responder_common.c \

      src/responder/common/data_provider/rdp_message.c \

      src/responder/common/data_provider/rdp_client.c \

@@ -2409,6 +2422,7 @@ nss_srv_tests_LDFLAGS = \

     -Wl,-wrap,sss_cmd_send_empty \

     -Wl,-wrap,sss_cmd_done

 nss_srv_tests_LDADD = \

+    $(LIBADD_DL) \

     $(CMOCKA_LIBS) \

     $(SSSD_LIBS) \

     $(SSSD_INTERNAL_LTLIBS) \

@@ -2444,6 +2458,7 @@ pam_srv_tests_LDFLAGS = \

     -Wl,-wrap,pam_dp_send_req \

     $(NULL)

 pam_srv_tests_LDADD = \

+    $(LIBADD_DL) \

     $(CMOCKA_LIBS) \

     $(PAM_LIBS) \

     $(SSSD_LIBS) \

@@ -2480,6 +2495,7 @@ ssh_srv_tests_LDFLAGS = \

     -Wl,-wrap,ssh_dp_send_req \

     $(NULL)

 ssh_srv_tests_LDADD = \

+    $(LIBADD_DL) \

     $(CMOCKA_LIBS) \

     $(SSSD_LIBS) \

     $(SSSD_INTERNAL_LTLIBS) \

@@ -2499,6 +2515,7 @@ responder_get_domains_tests_LDFLAGS = \

     -Wl,-wrap,sss_parse_name_for_domains \

     -Wl,-wrap,sss_ncache_reset_repopulate_permanent

 responder_get_domains_tests_LDADD = \

+    $(LIBADD_DL) \

     $(CMOCKA_LIBS) \

     $(SSSD_LIBS) \

     $(SSSD_INTERNAL_LTLIBS) \

@@ -2578,6 +2595,7 @@ test_negcache_CFLAGS = \

     $(TALLOC_CFLAGS) \

     $(DHASH_CFLAGS)

 test_negcache_LDADD = \

+    $(LIBADD_DL) \

     $(CMOCKA_LIBS) \

     $(SSSD_LIBS) \

     $(SYSTEMD_DAEMON_LIBS) \

@@ -2922,6 +2940,7 @@ ifp_tests_SOURCES = \

 ifp_tests_CFLAGS = \

     $(AM_CFLAGS)

 ifp_tests_LDADD = \

+    $(LIBADD_DL) \

     $(CMOCKA_LIBS) \

     $(SSSD_LIBS) \

     $(SSSD_INTERNAL_LTLIBS) \

@@ -3178,6 +3197,7 @@ responder_cache_req_tests_LDFLAGS = \

     -Wl,-wrap,sss_dp_get_account_send \

     $(NULL)

 responder_cache_req_tests_LDADD = \

+    $(LIBADD_DL) \

     $(CMOCKA_LIBS) \

     $(SSSD_LIBS) \

     $(SSSD_INTERNAL_LTLIBS) \

diff --git a/src/responder/common/negcache.c b/src/responder/common/negcache.c

index f9034d164..d6f72d816 100644

--- a/src/responder/common/negcache.c

+++ b/src/responder/common/negcache.c

@@ -19,14 +19,16 @@

    along with this program.  If not, see <http://www.gnu.org/licenses/>.

 */

+#include <fcntl.h>

+#include <time.h>

+#include "tdb.h"

 #include "util/util.h"

+#include "util/nss_dl_load.h"

 #include "confdb/confdb.h"

 #include "responder/common/negcache_files.h"

 #include "responder/common/responder.h"

 #include "responder/common/negcache.h"

-#include <fcntl.h>

-#include <time.h>

-#include "tdb.h"

+

 #define NC_ENTRY_PREFIX "NCE/"

 #define NC_USER_PREFIX NC_ENTRY_PREFIX"USER"

@@ -44,6 +46,7 @@ struct sss_nc_ctx {

     struct tdb_context *tdb;

     uint32_t timeout;

     uint32_t local_timeout;

+    struct sss_nss_ops ops;

 };

 typedef int (*ncache_set_byname_fn_t)(struct sss_nc_ctx *, bool,

@@ -63,14 +66,49 @@ static int string_to_tdb_data(char *str, TDB_DATA *ret)

     return EOK;

 }

+static errno_t ncache_load_nss_symbols(struct sss_nss_ops *ops)

+{

+    errno_t ret;

+    size_t i;

+

+    ret = sss_load_nss_symbols(ops, "files");

+    if (ret != EOK) {

+        return ret;

+    }

+

+    void *mandatory_syms[] = {

+        (void*)ops->getpwnam_r,

+        (void*)ops->getpwuid_r,

+        (void*)ops->getgrnam_r,

+        (void*)ops->getgrgid_r

+    };

+    for (i = 0; i < sizeof(mandatory_syms)/sizeof(mandatory_syms[0]); ++i) {

+        if (!mandatory_syms[i]) {

+            DEBUG(SSSDBG_CRIT_FAILURE, "The 'files' library does not provide mandatory function");

+            return ELIBBAD;

+        }

+    }

+

+    return EOK;

+}

+

 int sss_ncache_init(TALLOC_CTX *memctx, uint32_t timeout,

                     uint32_t local_timeout, struct sss_nc_ctx **_ctx)

 {

+    errno_t ret;

     struct sss_nc_ctx *ctx;

     ctx = talloc_zero(memctx, struct sss_nc_ctx);

     if (!ctx) return ENOMEM;

+    ret = ncache_load_nss_symbols(&ctx->ops);

+    if (ret != EOK) {

+        DEBUG(SSSDBG_FATAL_FAILURE, "Unable to load NSS symbols [%d]: %s\n",

+              ret, sss_strerror(ret));

+        talloc_free(ctx);

+        return ret;

+    }

+

     errno = 0;

     /* open a memory only tdb with default hash size */

     ctx->tdb = tdb_open("memcache", 0, TDB_INTERNAL, O_RDWR|O_CREAT, 0);

@@ -488,7 +526,7 @@ static int sss_ncache_set_user_int(struct sss_nc_ctx *ctx, bool permanent,

     if (!str) return ENOMEM;

     if ((!permanent) && (ctx->local_timeout > 0)) {

-        use_local_negative = is_user_local_by_name(name);

+        use_local_negative = is_user_local_by_name(&ctx->ops, name);

     }

     ret = sss_ncache_set_str(ctx, str, permanent, use_local_negative);

@@ -509,7 +547,7 @@ static int sss_ncache_set_group_int(struct sss_nc_ctx *ctx, bool permanent,

     if (!str) return ENOMEM;

     if ((!permanent) && (ctx->local_timeout > 0)) {

-        use_local_negative = is_group_local_by_name(name);

+        use_local_negative = is_group_local_by_name(&ctx->ops, name);

     }

     ret = sss_ncache_set_str(ctx, str, permanent, use_local_negative);

@@ -606,7 +644,7 @@ int sss_ncache_set_uid(struct sss_nc_ctx *ctx, bool permanent,

     if (!str) return ENOMEM;

     if ((!permanent) && (ctx->local_timeout > 0)) {

-        use_local_negative = is_user_local_by_uid(uid);

+        use_local_negative = is_user_local_by_uid(&ctx->ops, uid);

     }

     ret = sss_ncache_set_str(ctx, str, permanent, use_local_negative);

@@ -630,7 +668,7 @@ int sss_ncache_set_gid(struct sss_nc_ctx *ctx, bool permanent,

     if (!str) return ENOMEM;

     if ((!permanent) && (ctx->local_timeout > 0)) {

-        use_local_negative = is_group_local_by_gid(gid);

+        use_local_negative = is_group_local_by_gid(&ctx->ops, gid);

     }

     ret = sss_ncache_set_str(ctx, str, permanent, use_local_negative);

diff --git a/src/responder/common/negcache_files.c b/src/responder/common/negcache_files.c

index 4256186d9..85a7065a4 100644

--- a/src/responder/common/negcache_files.c

+++ b/src/responder/common/negcache_files.c

@@ -19,94 +19,90 @@

    along with this program.  If not, see <http://www.gnu.org/licenses/>.

 */

-#include <sys/types.h>

-#include <pwd.h>

-#include <grp.h>

 #include "util/util.h"

+#include "util/nss_dl_load.h"

 #include "responder/common/negcache_files.h"

 #define BUFFER_SIZE 16384

-bool is_user_local_by_name(const char *name)

+bool is_user_local_by_name(const struct sss_nss_ops *ops, const char *name)

 {

     struct passwd pwd = { 0 };

-    struct passwd *pwd_result;

+    int errnop;

     char buffer[BUFFER_SIZE];

-    bool is_local = false;

-    int ret;

+    enum nss_status ret;

     char *shortname = NULL;

+    int parse_ret;

-    ret = sss_parse_internal_fqname(NULL, name, &shortname, NULL);

-    if (ret != EOK) {

+    parse_ret = sss_parse_internal_fqname(NULL, name, &shortname, NULL);

+    if (parse_ret != EOK) {

         return false;

     }

-    ret = getpwnam_r(shortname, &pwd, buffer, BUFFER_SIZE, &pwd_result);

+    ret = ops->getpwnam_r(shortname, &pwd, buffer, BUFFER_SIZE, &errnop);

     talloc_free(shortname);

-    if (ret == EOK && pwd_result != NULL) {

+    if (ret == NSS_STATUS_SUCCESS) {

         DEBUG(SSSDBG_TRACE_FUNC, "User %s is a local user\n", name);

-        is_local = true;

+        return true;

     }

-    return is_local;

+    return false;

 }

-bool is_user_local_by_uid(uid_t uid)

+bool is_user_local_by_uid(const struct sss_nss_ops *ops, uid_t uid)

 {

     struct passwd pwd = { 0 };

-    struct passwd *pwd_result;

+    int errnop;

     char buffer[BUFFER_SIZE];

-    bool is_local = false;

-    int ret;

+    enum nss_status ret;

-    ret = getpwuid_r(uid, &pwd, buffer, BUFFER_SIZE, &pwd_result);

-    if (ret == EOK && pwd_result != NULL) {

+    ret = ops->getpwuid_r(uid, &pwd, buffer, BUFFER_SIZE, &errnop);

+    if (ret == NSS_STATUS_SUCCESS) {

         DEBUG(SSSDBG_TRACE_FUNC,

               "User with UID %"SPRIuid" is a local user\n", uid);

-        is_local = true;

+        return true;

     }

-    return is_local;

+    return false;

 }

-bool is_group_local_by_name(const char *name)

+bool is_group_local_by_name(const struct sss_nss_ops *ops, const char *name)

 {

     struct group grp = { 0 };

-    struct group *grp_result;

+    int errnop;

     char buffer[BUFFER_SIZE];

-    bool is_local = false;

-    int ret;

+    enum nss_status ret;

     char *shortname = NULL;

+    int parse_ret;

-    ret = sss_parse_internal_fqname(NULL, name, &shortname, NULL);

-    if (ret != EOK) {

+    parse_ret = sss_parse_internal_fqname(NULL, name, &shortname, NULL);

+    if (parse_ret != EOK) {

         return false;

     }

-    ret = getgrnam_r(shortname, &grp, buffer, BUFFER_SIZE, &grp_result);

+    ret = ops->getgrnam_r(shortname, &grp, buffer, BUFFER_SIZE, &errnop);

     talloc_free(shortname);

-    if (ret == EOK && grp_result != NULL) {

+    if (ret == NSS_STATUS_SUCCESS) {

         DEBUG(SSSDBG_TRACE_FUNC, "Group %s is a local group\n", name);

-        is_local = true;

+        return true;

     }

-    return is_local;

+    return false;

 }

-bool is_group_local_by_gid(uid_t gid)

+bool is_group_local_by_gid(const struct sss_nss_ops *ops, uid_t gid)

 {

     struct group grp = { 0 };

-    struct group *grp_result;

+    int errnop;

     char buffer[BUFFER_SIZE];

-    bool is_local = false;

-    int ret;

+    enum nss_status ret;

-    ret = getgrgid_r(gid, &grp, buffer, BUFFER_SIZE, &grp_result);

-    if (ret == EOK && grp_result != NULL) {

+    ret = ops->getgrgid_r(gid, &grp, buffer, BUFFER_SIZE, &errnop);

+    if (ret == NSS_STATUS_SUCCESS) {

         DEBUG(SSSDBG_TRACE_FUNC,

               "Group with GID %"SPRIgid" is a local group\n", gid);

-        is_local = true;

+        return true;

     }

-    return is_local;

+    return false;

 }

diff --git a/src/responder/common/negcache_files.h b/src/responder/common/negcache_files.h

index 01d9f0828..a3e18deb0 100644

--- a/src/responder/common/negcache_files.h

+++ b/src/responder/common/negcache_files.h

@@ -22,10 +22,14 @@

 #ifndef _NEGCACHE_FILES_H_

 #define _NEGCACHE_FILES_H_

-bool is_user_local_by_name(const char *name);

-bool is_user_local_by_uid(uid_t uid);

+#include <stdbool.h>

-bool is_group_local_by_name(const char *name);

-bool is_group_local_by_gid(uid_t gid);

+struct sss_nss_ops;

+

+bool is_user_local_by_name(const struct sss_nss_ops *ops, const char *name);

+bool is_user_local_by_uid(const struct sss_nss_ops *ops, uid_t uid);

+

+bool is_group_local_by_name(const struct sss_nss_ops *ops, const char *name);

+bool is_group_local_by_gid(const struct sss_nss_ops *ops, uid_t gid);

 #endif /* _NEGCACHE_FILES_H_ */

diff --git a/src/tests/cwrap/Makefile.am b/src/tests/cwrap/Makefile.am

index a559abe9e..bfc493395 100644

--- a/src/tests/cwrap/Makefile.am

+++ b/src/tests/cwrap/Makefile.am

@@ -75,6 +75,7 @@ SSSD_RESPONDER_IFACE_OBJ = \

 SSSD_RESPONDER_OBJ = \

     ../../../src/responder/common/negcache_files.c \

+    ../../../src/util/nss_dl_load.c \

     ../../../src/responder/common/negcache.c \

     ../../../src/responder/common/responder_cmd.c \

     ../../../src/responder/common/responder_common.c \

@@ -175,6 +176,7 @@ responder_common_tests_SOURCES =\

     ../../../src/responder/common/iface/responder_ncache.c \

     ../../../src/responder/common/iface/responder_iface_generated.c \

     ../../../src/responder/common/negcache_files.c \

+    ../../../src/util/nss_dl_load.c \

     ../../../src/responder/common/negcache.c \

     ../../../src/responder/common/data_provider/rdp_message.c \

     ../../../src/responder/common/data_provider/rdp_client.c \

@@ -189,6 +191,7 @@ responder_common_tests_CFLAGS = \

     $(AM_CFLAGS) \

     $(NULL)

 responder_common_tests_LDADD = \

+    $(LIBADD_DL) \

     $(CMOCKA_LIBS) \

     $(SSSD_LIBS) \

     $(SELINUX_LIBS) \

@@ -207,6 +210,7 @@ negcache_tests_CFLAGS = \

     -DBASE_FILE_STEM=\"$(*F)\" \

     $(NULL)

 negcache_tests_LDADD = \

+    $(LIBADD_DL) \

     $(CMOCKA_LIBS) \

     $(SSSD_LIBS) \

     $(SELINUX_LIBS) \

diff --git a/src/tests/cwrap/test_negcache.c b/src/tests/cwrap/test_negcache.c

index c4f601b34..690e797e2 100644

--- a/src/tests/cwrap/test_negcache.c

+++ b/src/tests/cwrap/test_negcache.c

@@ -18,6 +18,10 @@

     along with this program.  If not, see <http://www.gnu.org/licenses/>.

 */

+#include <stdio.h>

+#include <sys/types.h>

+#include <pwd.h>

+

 #include <stdarg.h>

 #include <stddef.h>

 #include <setjmp.h>

@@ -35,38 +39,40 @@

 #define TEST_CONF_DB "test_negcache_confdb.ldb"

 #define TEST_DOM_NAME "test_domain.test"

-#define TEST_LOCAL_USER_NAME_1 "foobar"

-#define TEST_LOCAL_USER_NAME_2 "sssd"

-

-#define TEST_LOCAL_USER_UID_1 10001

-#define TEST_LOCAL_USER_UID_2 123

-

-#define TEST_LOCAL_GROUP_NAME_1 "foogroup"

-#define TEST_LOCAL_GROUP_NAME_2 "sssd"

-

-#define TEST_LOCAL_GID_1 10001

-#define TEST_LOCAL_GID_2 123

-

-struct test_user {

+struct user_descriptor_t {

     const char *name;

     uid_t uid;

+};

+

+struct group_descriptor_t {

+    const char *name;

     gid_t gid;

-} users[] = { { "test_user1", 1001, 50001 },

-              { "test_user2", 1002, 50002 } };

+};

-static void create_users(TALLOC_CTX *mem_ctx,

-                         struct sss_domain_info *domain)

+struct ncache_test_ctx {

+    struct sss_test_ctx *tctx;

+    struct sss_nc_ctx *ncache;

+    struct user_descriptor_t local_users[2];

+    struct user_descriptor_t non_local_users[2];

+    struct group_descriptor_t local_groups[2];

+    struct group_descriptor_t non_local_groups[2];

+};

+

+static void create_users(struct ncache_test_ctx *test_ctx)

 {

     errno_t ret;

     char *fqname;

+    struct sss_domain_info *domain = test_ctx->tctx->dom;

+    const struct user_descriptor_t *users = test_ctx->non_local_users;

+    const struct group_descriptor_t *groups = test_ctx->non_local_groups;

     for (int i = 0; i < 2; i++) {

-        fqname = sss_create_internal_fqname(mem_ctx,

+        fqname = sss_create_internal_fqname(test_ctx,

                                             users[i].name,

                                             domain->name);

         assert_non_null(fqname);

-        ret = sysdb_add_user(domain, users[i].name, users[i].uid, users[i].gid,

+        ret = sysdb_add_user(domain, users[i].name, users[i].uid, groups[i].gid,

                              fqname, NULL, "/bin/bash", domain->name,

                              NULL, 30, time(NULL));

         talloc_free(fqname);

@@ -74,25 +80,15 @@ static void create_users(TALLOC_CTX *mem_ctx,

     }

 }

-struct test_group {

-    const char *name;

-    gid_t gid;

-} groups[] = { { "test_group1", 50001 },

-               { "test_group2", 50002 } };

-

-struct ncache_test_ctx {

-    struct sss_test_ctx *tctx;

-    struct sss_nc_ctx *ncache;

-};

-

-static void create_groups(TALLOC_CTX *mem_ctx,

-                          struct sss_domain_info *domain)

+static void create_groups(struct ncache_test_ctx *test_ctx)

 {

     errno_t ret;

     char *fqname;

+    struct sss_domain_info *domain = test_ctx->tctx->dom;

+    const struct group_descriptor_t *groups = test_ctx->non_local_groups;

     for (int i = 0; i < 2; i++) {

-        fqname = sss_create_internal_fqname(mem_ctx,

+        fqname = sss_create_internal_fqname(test_ctx,

                                             groups[i].name,

                                             domain->name);

         assert_non_null(fqname);

@@ -116,6 +112,114 @@ struct cli_protocol_version *register_cli_protocol_version(void)

     return responder_test_cli_protocol_version;

 }

+static void find_local_users(struct ncache_test_ctx *test_ctx)

+{

+    int i;

+    FILE *passwd_file;

+    const struct passwd *pwd;

+

+    passwd_file = fopen("/etc/passwd", "r");

+    assert_non_null(passwd_file);

+

+    for (i = 0; i < 2; /*no-op*/) {

+        pwd = fgetpwent(passwd_file);

+        assert_non_null(pwd);

+        if (pwd->pw_uid == 0) {

+            /* skip root */

+            continue;

+        }

+        test_ctx->local_users[i].uid = pwd->pw_uid;

+        test_ctx->local_users[i].name = talloc_strdup(test_ctx, pwd->pw_name);

+        assert_non_null(test_ctx->local_users[i].name);

+        ++i;

+    }

+

+    fclose(passwd_file);

+}

+

+static void find_local_groups(struct ncache_test_ctx *test_ctx)

+{

+    int i;

+    FILE *group_file;

+    const struct group *grp;

+

+    group_file = fopen("/etc/group", "r");

+    assert_non_null(group_file);

+

+    for (i = 0; i < 2; /* no-op */) {

+        grp = fgetgrent(group_file);

+        assert_non_null(grp);

+        if (grp->gr_gid == 0) {

+            /* skip root */

+            continue;

+        }

+        test_ctx->local_groups[i].gid = grp->gr_gid;

+        test_ctx->local_groups[i].name = talloc_strdup(test_ctx, grp->gr_name);

+        assert_non_null(test_ctx->local_groups[i].name);

+        ++i;

+    }

+

+    fclose(group_file);

+}

+

+static void find_non_local_users(struct ncache_test_ctx *test_ctx)

+{

+    int i;

+    int k;

+    uid_t uid;

+    char *name;

+

+    for (i = 0, k = 1; (k < 100) && (i < 2); ++k) {

+        uid = 65534-k;

+        if (getpwuid(uid)) {

+            continue;

+        }

+        test_ctx->non_local_users[i].uid = uid;

+        ++i;

+    }

+    assert_int_equal(i, 2);

+

+    for (i = 0, k = 0; (k < 100) && (i < 2); ++k) {

+        name = talloc_asprintf(test_ctx, "nctestuser%d", k);

+        if (getpwnam(name)) {

+            talloc_free(name);

+            continue;

+        }

+        test_ctx->non_local_users[i].name = name;

+        ++i;

+    }

+    assert_int_equal(i, 2);

+}

+

+static void find_non_local_groups(struct ncache_test_ctx *test_ctx)

+{

+    int i = 0;

+    int k;

+    gid_t gid;

+    char *name;

+

+    for (i = 0, k = 1; (k < 100) && (i < 2); ++k) {

+        gid = 65534-k;

+        if (getgrgid(gid)) {

+            continue;

+        }

+        test_ctx->non_local_groups[i].gid = gid;

+        ++i;

+    }

+    assert_int_equal(i, 2);

+

+    for (i = 0, k = 0; (k < 100) && (i < 2); ++k) {

+        name = talloc_asprintf(test_ctx, "nctestgroup%d", k);

+        if (getgrnam(name)) {

+            talloc_free(name);

+            continue;

+        }

+        test_ctx->non_local_groups[i].name = name;

+        ++i;

+    }

+    assert_int_equal(i, 2);

+}

+