From 0dde096aac1db7d8533f51254f6a8c22a67114d8 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Mon, 2 Aug 2021 15:53:42 +0200 Subject: [PATCH] sysdb: more specific mpg search filter MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Originally all user of an mpg domain had an automatically created user-private group and as a result the ID space was unified in the sense that a given ID either belongs to a group or to a user with a user-private group. With the introduction of id-overrides and the auto_private_groups option this assumption is not true anymore and as a result the search filter for GIDs must be more specific with respect to the user objects. Resolves: https://github.com/SSSD/sssd/issues/5790 :fixes: Improve mpg search filter to be more reliable with id-overrides and the new auto_private_groups options. Reviewed-by: Pavel Březina (cherry picked from commit 4be5fcd9afd62b1094eb27970627d327ac770127) Reviewed-by: Tomáš Halman --- src/db/sysdb.h | 2 +- src/db/sysdb_search.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/db/sysdb.h b/src/db/sysdb.h index c771ce633..c601c251f 100644 --- a/src/db/sysdb.h +++ b/src/db/sysdb.h @@ -215,7 +215,7 @@ #define SYSDB_GRSID_FILTER "(&("SYSDB_GC")("SYSDB_SID_STR"=%s))" #define SYSDB_GRENT_FILTER "("SYSDB_GC")" #define SYSDB_GRNAM_MPG_FILTER "(&("SYSDB_MPGC")(|("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME_ALIAS"=%s)("SYSDB_NAME"=%s)))" -#define SYSDB_GRGID_MPG_FILTER "(&("SYSDB_MPGC")("SYSDB_GIDNUM"=%lu))" +#define SYSDB_GRGID_MPG_FILTER "(|(&("SYSDB_GC")("SYSDB_GIDNUM"=%lu))(&("SYSDB_UC")("SYSDB_GIDNUM"=%lu)("SYSDB_UIDNUM"=%lu)))" #define SYSDB_GRENT_MPG_FILTER "("SYSDB_MPGC")" #define SYSDB_INITGR_FILTER "(&("SYSDB_GC")("SYSDB_GIDNUM"=*))" diff --git a/src/db/sysdb_search.c b/src/db/sysdb_search.c index 7939944ba..d783abc68 100644 --- a/src/db/sysdb_search.c +++ b/src/db/sysdb_search.c @@ -1355,7 +1355,7 @@ int sysdb_getgrgid_attrs(TALLOC_CTX *mem_ctx, } ret = ldb_search(domain->sysdb->ldb, tmp_ctx, &res, base_dn, - LDB_SCOPE_SUBTREE, attrs, fmt_filter, ul_gid); + LDB_SCOPE_SUBTREE, attrs, fmt_filter, ul_gid, ul_gid, ul_gid); if (ret != EOK) { ret = sysdb_error_to_errno(ret); goto done; -- 2.26.3