From 48f27f74c9a9d5aebf8d2be941dfb282578ba9ba Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 12 Mar 2021 14:38:54 +0100
Subject: [PATCH] negcache: use right domain in nss_protocol_fill_initgr()

When checking if a group returned by an initgroups request is filtered
in the negative cache the domain of the user was used. This does not
work reliable if the user can be a member of groups from multiple
domains.

With this patch th domain the group belongs to is determined and used
while checking the negative cache.

Resolves: https://github.com/SSSD/sssd/issues/5534
(cherry picked from commit 231d1118727b989a4af9911a45a465912fe659d6 with changes)

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
---
 src/db/sysdb.c                         | 22 ++++++++++++++++++++++
 src/db/sysdb.h                         |  7 +++++++
 src/responder/nss/nss_protocol_grent.c |  8 +++++---
 3 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/src/db/sysdb.c b/src/db/sysdb.c
index 279bd5839..f9929c7ba 100644
--- a/src/db/sysdb.c
+++ b/src/db/sysdb.c
@@ -1978,3 +1978,25 @@ done:
     talloc_free(tmp_ctx);
     return differs;
 }
+
+struct sss_domain_info *find_domain_by_msg(struct sss_domain_info *dom,
+                                           struct ldb_message *msg)
+{
+    const char *name;
+    struct sss_domain_info *obj_dom = NULL;
+
+    name = ldb_msg_find_attr_as_string(msg, SYSDB_NAME, NULL);
+    if (name == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Object does not have a name attribute.\n");
+        return dom;
+    }
+
+    obj_dom = find_domain_by_object_name(get_domains_head(dom), name);
+    if (obj_dom == NULL) {
+        DEBUG(SSSDBG_OP_FAILURE, "No domain found for [%s].\n", name);
+        return dom;
+    }
+
+    return obj_dom;
+}
diff --git a/src/db/sysdb.h b/src/db/sysdb.h
index 679763bad..d47099eff 100644
--- a/src/db/sysdb.h
+++ b/src/db/sysdb.h
@@ -1505,4 +1505,11 @@ errno_t sysdb_handle_original_uuid(const char *orig_name,
                                    struct sysdb_attrs *dest_attrs,
                                    const char *dest_name);
 
+/* Try to detect the object domain from the object's SYSDB_NAME attribute and
+ * return the matching sss_domain_info. This should work reliable with user
+ * and group objects since fully-qualified names are used here. If the proper
+ * domain cannot be detected the given domain is returned. */
+struct sss_domain_info *find_domain_by_msg(struct sss_domain_info *dom,
+                                           struct ldb_message *msg);
+
 #endif /* __SYS_DB_H__ */
diff --git a/src/responder/nss/nss_protocol_grent.c b/src/responder/nss/nss_protocol_grent.c
index 4c7ea9aed..e4494826a 100644
--- a/src/responder/nss/nss_protocol_grent.c
+++ b/src/responder/nss/nss_protocol_grent.c
@@ -343,6 +343,7 @@ nss_protocol_fill_initgr(struct nss_ctx *nss_ctx,
                          struct cache_req_result *result)
 {
     struct sss_domain_info *domain;
+    struct sss_domain_info *grp_dom;
     struct ldb_message *user;
     struct ldb_message *msg;
     struct ldb_message *primary_group_msg;
@@ -400,10 +401,11 @@ nss_protocol_fill_initgr(struct nss_ctx *nss_ctx,
     num_results = 0;
     for (i = 1; i < result->count; i++) {
         msg = result->msgs[i];
-        gid = sss_view_ldb_msg_find_attr_as_uint64(domain, msg, SYSDB_GIDNUM,
+        grp_dom = find_domain_by_msg(domain, msg);
+        gid = sss_view_ldb_msg_find_attr_as_uint64(grp_dom, msg, SYSDB_GIDNUM,
                                                    0);
         posix = ldb_msg_find_attr_as_string(msg, SYSDB_POSIX, NULL);
-        grp_name = sss_view_ldb_msg_find_attr_as_string(domain, msg, SYSDB_NAME,
+        grp_name = sss_view_ldb_msg_find_attr_as_string(grp_dom, msg, SYSDB_NAME,
                                                         NULL);
 
         if (gid == 0) {
@@ -417,7 +419,7 @@ nss_protocol_fill_initgr(struct nss_ctx *nss_ctx,
             }
         }
 
-        if (is_group_filtered(nss_ctx->rctx->ncache, domain, grp_name, gid)) {
+        if (is_group_filtered(nss_ctx->rctx->ncache, grp_dom, grp_name, gid)) {
             continue;
         }
 
-- 
2.26.3