[PATCH 1/2] SYSDB: make the sss_ldb_modify_permissive function public
SSIA
[PATCH 2/2] SYSDB: Expire group if adding ghost users fails with EEXIST
In some cases, the ghost attribute is propagated from a nested group
before being added during upgrade. In those cases, we need to ignore
EEXIST from the memberof ldb module to carry on with the upgrade and
also expire the group to make sure the correct group memberships are
fetched on the next lookup.
>From f824088d3351258a13ca5390e0061e34348f235f Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <[email protected]>
Date: Wed, 23 Jan 2013 17:17:38 +0100
Subject: [PATCH 1/2] SYSDB: make the sss_ldb_modify_permissive function public
---
src/db/sysdb.h | 4 ++++
src/db/sysdb_ops.c | 9 +++++++--
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/src/db/sysdb.h b/src/db/sysdb.h
index
d4af5fa6bb46dfb2656924f319369d495d52a004..5c33ab287319b92f579038f1376328cc6517ff06
100644
--- a/src/db/sysdb.h
+++ b/src/db/sysdb.h
@@ -482,6 +482,10 @@ int sysdb_get_netgroup_attr(TALLOC_CTX *mem_ctx,
* they have to be called within a transaction
* See sysdb_transaction_send()/_recv() */
+/* Permissive modify */
+int sss_ldb_modify_permissive(struct ldb_context *ldb,
+ struct ldb_message *msg);
+
/* Delete Entry */
int sysdb_delete_entry(struct sysdb_ctx *sysdb,
struct ldb_dn *dn,
diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c
index
46ab64d3913fff43ecf9d1c010ef36bf0cd19feb..0fb8ed49ea16e602179baec4c604cef95c05e7ea
100644
--- a/src/db/sysdb_ops.c
+++ b/src/db/sysdb_ops.c
@@ -74,8 +74,13 @@ static uint32_t get_attr_as_uint32(struct ldb_message *msg,
const char *attr)
return l;
}
-static int sss_ldb_modify_permissive(struct ldb_context *ldb,
- struct ldb_message *msg)
+/*
+ * The wrapper around ldb_modify that uses LDB_CONTROL_PERMISSIVE_MODIFY_OID
+ * so that on adds entries that already exist are skipped and similarly
+ * entries that are missing are ignored on deletes
+ */
+int sss_ldb_modify_permissive(struct ldb_context *ldb,
+ struct ldb_message *msg)
{
struct ldb_request *req;
int ret = EOK;
--
1.8.1
>From fdaf06e2002b7a7a4e796f2623b31ed648be521c Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <[email protected]>
Date: Wed, 23 Jan 2013 17:17:55 +0100
Subject: [PATCH 2/2] SYSDB: Expire group if adding ghost users fails with
EEXIST
---
src/db/sysdb_upgrade.c | 38 ++++++++++++++++++++++++++++++++++++--
1 file changed, 36 insertions(+), 2 deletions(-)
diff --git a/src/db/sysdb_upgrade.c b/src/db/sysdb_upgrade.c
index
673c633ebeb25d32ca4634a71da2bdf2aacd2016..6f7ac393cb0c0dd2591883b0dffc0a0101e376cc
100644
--- a/src/db/sysdb_upgrade.c
+++ b/src/db/sysdb_upgrade.c
@@ -1098,9 +1098,43 @@ int sysdb_upgrade_10(struct sysdb_ctx *sysdb, struct
sss_domain_info *domain,
DEBUG(SSSDBG_TRACE_FUNC, ("Adding ghost [%s] to entry [%s]\n",
name, ldb_dn_get_linearized(msg->dn)));
- ret = ldb_modify(sysdb->ldb, msg);
+ ret = sss_ldb_modify_permissive(sysdb->ldb, msg);
talloc_zfree(msg);
- if (ret != LDB_SUCCESS) {
+ if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
+ /* If we failed adding the ghost user(s) because the values
already
+ * exist, they were probably propagated from a parent that was
+ * upgraded before us. Mark the group as expired so that it is
+ * refreshed on next request.
+ */
+ msg = ldb_msg_new(tmp_ctx);
+ if (msg == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ msg->dn = ldb_dn_from_ldb_val(tmp_ctx, sysdb->ldb,
&memberof_el->values[j]);
+ if (msg->dn == NULL) {
+ ret = ENOMEM;
+ goto done;
+ }
+
+ ret = ldb_msg_add_empty(msg, SYSDB_CACHE_EXPIRE,
+ LDB_FLAG_MOD_REPLACE, NULL);
+ if (ret != LDB_SUCCESS) {
+ goto done;
+ }
+
+ ret = ldb_msg_add_string(msg, SYSDB_CACHE_EXPIRE, "1");
+ if (ret != LDB_SUCCESS) {
+ goto done;
+ }
+
+ ret = sss_ldb_modify_permissive(sysdb->ldb, msg);
+ talloc_zfree(msg);
+ if (ret != LDB_SUCCESS) {
+ goto done;
+ }
+ } else if (ret != LDB_SUCCESS) {
ret = sysdb_error_to_errno(ret);
goto done;
}
--
1.8.1
_______________________________________________
sssd-devel mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
