From 0dde096aac1db7d8533f51254f6a8c22a67114d8 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Mon, 2 Aug 2021 15:53:42 +0200
Subject: [PATCH] sysdb: more specific mpg search filter
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Originally all user of an mpg domain had an automatically created
user-private group and as a result the ID space was unified in the sense
that a given ID either belongs to a group or to a user with a
user-private group.

With the introduction of id-overrides and the auto_private_groups option
this assumption is not true anymore and as a result the search filter
for GIDs must be more specific with respect to the user objects.

Resolves: https://github.com/SSSD/sssd/issues/5790

:fixes: Improve mpg search filter to be more reliable with id-overrides
  and the new auto_private_groups options.

Reviewed-by: Pavel Březina <pbrezina@redhat.com>
(cherry picked from commit 4be5fcd9afd62b1094eb27970627d327ac770127)

Reviewed-by: Tomáš Halman <thalman@redhat.com>
---
 src/db/sysdb.h        | 2 +-
 src/db/sysdb_search.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/db/sysdb.h b/src/db/sysdb.h
index c771ce633..c601c251f 100644
--- a/src/db/sysdb.h
+++ b/src/db/sysdb.h
@@ -215,7 +215,7 @@
 #define SYSDB_GRSID_FILTER "(&("SYSDB_GC")("SYSDB_SID_STR"=%s))"
 #define SYSDB_GRENT_FILTER "("SYSDB_GC")"
 #define SYSDB_GRNAM_MPG_FILTER "(&("SYSDB_MPGC")(|("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME"=%s)))"
-#define SYSDB_GRGID_MPG_FILTER "(&("SYSDB_MPGC")("SYSDB_GIDNUM"=%lu))"
+#define SYSDB_GRGID_MPG_FILTER "(|(&("SYSDB_GC")("SYSDB_GIDNUM"=%lu))(&("SYSDB_UC")("SYSDB_GIDNUM"=%lu)("SYSDB_UIDNUM"=%lu)))"
 #define SYSDB_GRENT_MPG_FILTER "("SYSDB_MPGC")"
 
 #define SYSDB_INITGR_FILTER "(&("SYSDB_GC")("SYSDB_GIDNUM"=*))"
diff --git a/src/db/sysdb_search.c b/src/db/sysdb_search.c
index 7939944ba..d783abc68 100644
--- a/src/db/sysdb_search.c
+++ b/src/db/sysdb_search.c
@@ -1355,7 +1355,7 @@ int sysdb_getgrgid_attrs(TALLOC_CTX *mem_ctx,
         }
 
         ret = ldb_search(domain->sysdb->ldb, tmp_ctx, &res, base_dn,
-                         LDB_SCOPE_SUBTREE, attrs, fmt_filter, ul_gid);
+                         LDB_SCOPE_SUBTREE, attrs, fmt_filter, ul_gid, ul_gid, ul_gid);
         if (ret != EOK) {
             ret = sysdb_error_to_errno(ret);
             goto done;
-- 
2.26.3