|
 |
6070bf |
From 09bf564bfe4f6f8407056e3261bfc7948d45bdbf Mon Sep 17 00:00:00 2001
|
|
|
6070bf |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
6070bf |
Date: Tue, 21 Jul 2015 11:44:03 +0200
|
|
|
6070bf |
Subject: [PATCH 210/210] IPA: Remove MPG groups if getgrgid was called before
|
|
|
6070bf |
getpw()
|
|
|
6070bf |
|
|
|
6070bf |
https://fedorahosted.org/sssd/ticket/2724
|
|
|
6070bf |
|
|
|
6070bf |
This bug only affects IPA clients that are connected to IPA servers with
|
|
|
6070bf |
AD trust and ID mapping in effect.
|
|
|
6070bf |
|
|
|
6070bf |
If an IPA client calls getgrgid() for an ID that matches a user, the
|
|
|
6070bf |
user's private group would be returned and stored as a group entry.
|
|
|
6070bf |
|
|
|
6070bf |
Subsequent queries for that user would fail, because MPG domains impose
|
|
|
6070bf |
uniqueness restriction for both the ID and name space across groups and
|
|
|
6070bf |
users.
|
|
|
6070bf |
|
|
|
6070bf |
To work around that, we remove the UPG groups in MPG domains during a
|
|
|
6070bf |
group lookup.
|
|
|
6070bf |
|
|
|
6070bf |
Reviewed-by: Sumit Bose <sbose@redhat.com>
|
|
|
6070bf |
---
|
|
|
6070bf |
src/providers/ipa/ipa_s2n_exop.c | 41 ++++++++++++++++++++++++++++++++++++++--
|
|
|
6070bf |
1 file changed, 39 insertions(+), 2 deletions(-)
|
|
|
6070bf |
|
|
|
6070bf |
diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
6070bf |
index 292f174257fbf6f6ebc8db6d1eb38cb4b5349b81..8de46136d0bc9d1c26b44c532d7bd405880aca50 100644
|
|
|
6070bf |
--- a/src/providers/ipa/ipa_s2n_exop.c
|
|
|
6070bf |
+++ b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
6070bf |
@@ -1757,6 +1757,7 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
|
|
|
6070bf |
int tret;
|
|
|
6070bf |
struct sysdb_attrs *gid_override_attrs = NULL;
|
|
|
6070bf |
char ** exop_grouplist;
|
|
|
6070bf |
+ struct ldb_message *msg;
|
|
|
6070bf |
|
|
|
6070bf |
tmp_ctx = talloc_new(NULL);
|
|
|
6070bf |
if (tmp_ctx == NULL) {
|
|
|
6070bf |
@@ -1997,8 +1998,44 @@ static errno_t ipa_s2n_save_objects(struct sss_domain_info *dom,
|
|
|
6070bf |
attrs->a.user.pw_dir, attrs->a.user.pw_shell,
|
|
|
6070bf |
NULL, attrs->sysdb_attrs, NULL,
|
|
|
6070bf |
timeout, now);
|
|
|
6070bf |
- if (ret != EOK) {
|
|
|
6070bf |
- DEBUG(SSSDBG_OP_FAILURE, "sysdb_store_user failed.\n");
|
|
|
6070bf |
+ if (ret == EEXIST && dom->mpg == true) {
|
|
|
6070bf |
+ /* This handles the case where getgrgid() was called for
|
|
|
6070bf |
+ * this user, so a group was created in the cache
|
|
|
6070bf |
+ */
|
|
|
6070bf |
+ ret = sysdb_search_group_by_name(tmp_ctx, dom, name, NULL, &msg;;
|
|
|
6070bf |
+ if (ret != EOK) {
|
|
|
6070bf |
+ /* Fail even on ENOENT, the group must be around */
|
|
|
6070bf |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
6070bf |
+ "Could not delete MPG group [%d]: %s\n",
|
|
|
6070bf |
+ ret, sss_strerror(ret));
|
|
|
6070bf |
+ goto done;
|
|
|
6070bf |
+ }
|
|
|
6070bf |
+
|
|
|
6070bf |
+ ret = sysdb_delete_group(dom, NULL, attrs->a.user.pw_uid);
|
|
|
6070bf |
+ if (ret != EOK) {
|
|
|
6070bf |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
6070bf |
+ "sysdb_delete_group failed for MPG group [%d]: %s\n",
|
|
|
6070bf |
+ ret, sss_strerror(ret));
|
|
|
6070bf |
+ goto done;
|
|
|
6070bf |
+ }
|
|
|
6070bf |
+
|
|
|
6070bf |
+ ret = sysdb_store_user(dom, name, NULL,
|
|
|
6070bf |
+ attrs->a.user.pw_uid,
|
|
|
6070bf |
+ gid, attrs->a.user.pw_gecos,
|
|
|
6070bf |
+ attrs->a.user.pw_dir,
|
|
|
6070bf |
+ attrs->a.user.pw_shell,
|
|
|
6070bf |
+ NULL, attrs->sysdb_attrs, NULL,
|
|
|
6070bf |
+ timeout, now);
|
|
|
6070bf |
+ if (ret != EOK) {
|
|
|
6070bf |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
6070bf |
+ "sysdb_store_user failed for MPG user [%d]: %s\n",
|
|
|
6070bf |
+ ret, sss_strerror(ret));
|
|
|
6070bf |
+ goto done;
|
|
|
6070bf |
+ }
|
|
|
6070bf |
+ } else if (ret != EOK) {
|
|
|
6070bf |
+ DEBUG(SSSDBG_OP_FAILURE,
|
|
|
6070bf |
+ "sysdb_store_user failed [%d]: %s\n",
|
|
|
6070bf |
+ ret, sss_strerror(ret));
|
|
|
6070bf |
goto done;
|
|
|
6070bf |
}
|
|
|
6070bf |
|
|
|
6070bf |
--
|
|
|
6070bf |
2.4.3
|
|
|
6070bf |
|