https://fedorahosted.org/sssd/ticket/1677
0001:
just a very little refactoring when touching the function
0002:
Resolve primary group in addition to secondary groups, so we don't
longer require memberUid present in the primary group.
However, if the memberUid is present, it may happen that the group is
included in the list twice, which means that it will be included in the
sysdb filter twice. I think this to be a better solution than to go over
all secondary groups and test whether it is also user's primary group.
From 564489b6590dca6bc561dbb7e986d7fb0905272f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <[email protected]>
Date: Thu, 13 Dec 2012 12:09:56 +0100
Subject: [PATCH 1/2] sysdb_get_sudo_user_info() initialize attrs on
declaration
---
src/db/sysdb_sudo.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/src/db/sysdb_sudo.c b/src/db/sysdb_sudo.c
index 39b1504da4e1c2ea4cc4e806f430f5adde3e9f3b..9e849ddb0e0017f3fd66989d08d919d6932daee7 100644
--- a/src/db/sysdb_sudo.c
+++ b/src/db/sysdb_sudo.c
@@ -290,19 +290,18 @@ sysdb_get_sudo_user_info(TALLOC_CTX *mem_ctx, const char *username,
{
TALLOC_CTX *tmp_ctx;
errno_t ret;
- const char *attrs[3];
struct ldb_message *msg;
char **sysdb_groupnames = NULL;
struct ldb_message_element *groups;
uid_t uid = 0;
int i;
+ const char *attrs[] = { SYSDB_MEMBEROF,
+ SYSDB_UIDNUM,
+ NULL };
tmp_ctx = talloc_new(NULL);
NULL_CHECK(tmp_ctx, ret, done);
- attrs[0] = SYSDB_MEMBEROF;
- attrs[1] = SYSDB_UIDNUM;
- attrs[2] = NULL;
ret = sysdb_search_user_by_name(tmp_ctx, sysdb, username,
attrs, &msg);
if (ret != EOK) {
--
1.7.11.7
From 26a111451fdefaea3298a02156aa19b905dd2f26 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <[email protected]>
Date: Thu, 13 Dec 2012 12:08:20 +0100
Subject: [PATCH 2/2] sudo: include primary group in user group list
https://fedorahosted.org/sssd/ticket/1677
---
src/db/sysdb_sudo.c | 42 +++++++++++++++++++++++++++++++++++++++++-
1 file changed, 41 insertions(+), 1 deletion(-)
diff --git a/src/db/sysdb_sudo.c b/src/db/sysdb_sudo.c
index 9e849ddb0e0017f3fd66989d08d919d6932daee7..c1845f9bebce254152922d6f344f216e7368b2e8 100644
--- a/src/db/sysdb_sudo.c
+++ b/src/db/sysdb_sudo.c
@@ -291,13 +291,20 @@ sysdb_get_sudo_user_info(TALLOC_CTX *mem_ctx, const char *username,
TALLOC_CTX *tmp_ctx;
errno_t ret;
struct ldb_message *msg;
+ struct ldb_message *group_msg = NULL;
char **sysdb_groupnames = NULL;
+ const char *primary_group = NULL;
struct ldb_message_element *groups;
uid_t uid = 0;
+ gid_t gid = 0;
+ size_t num_groups = 0;
int i;
const char *attrs[] = { SYSDB_MEMBEROF,
+ SYSDB_GIDNUM,
SYSDB_UIDNUM,
NULL };
+ const char *group_attrs[] = { SYSDB_NAME,
+ NULL };
tmp_ctx = talloc_new(NULL);
NULL_CHECK(tmp_ctx, ret, done);
@@ -318,13 +325,16 @@ sysdb_get_sudo_user_info(TALLOC_CTX *mem_ctx, const char *username,
}
}
+ /* resolve secondary groups */
if (groupnames != NULL) {
groups = ldb_msg_find_element(msg, SYSDB_MEMBEROF);
if (!groups || groups->num_values == 0) {
/* No groups for this user in sysdb currently */
sysdb_groupnames = NULL;
+ num_groups = 0;
} else {
- sysdb_groupnames = talloc_array(tmp_ctx, char *, groups->num_values+1);
+ num_groups = groups->num_values;
+ sysdb_groupnames = talloc_array(tmp_ctx, char *, num_groups + 1);
NULL_CHECK(sysdb_groupnames, ret, done);
/* Get a list of the groups by groupname only */
@@ -342,6 +352,36 @@ sysdb_get_sudo_user_info(TALLOC_CTX *mem_ctx, const char *username,
}
}
+ /* resolve primary group */
+ gid = ldb_msg_find_attr_as_uint64(msg, SYSDB_GIDNUM, 0);
+ if (gid != 0) {
+ ret = sysdb_search_group_by_gid(tmp_ctx, sysdb, gid,
+ group_attrs, &group_msg);
+ if (ret == EOK) {
+ primary_group = ldb_msg_find_attr_as_string(group_msg, SYSDB_NAME,
+ NULL);
+ if (primary_group == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ num_groups++;
+ sysdb_groupnames = talloc_realloc(tmp_ctx, sysdb_groupnames,
+ char *, num_groups + 1);
+ NULL_CHECK(sysdb_groupnames, ret, done);
+
+ sysdb_groupnames[num_groups - 1] = talloc_strdup(sysdb_groupnames,
+ primary_group);
+ NULL_CHECK(sysdb_groupnames[num_groups - 1], ret, done);
+
+ sysdb_groupnames[num_groups] = NULL;
+ } else if (ret != ENOENT) {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Error looking up group [%d]: %s\n",
+ ret, strerror(ret)));
+ goto done;
+ }
+ }
+
ret = EOK;
if (_uid != NULL) {
--
1.7.11.7
_______________________________________________
sssd-devel mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
