[Bug nis/10085] nss_compat cannot handle split groups in NIS for initgroups()

[Bug nis/10085] nss_compat cannot handle split groups in NIS for initgroups()

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=10085

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
                 CC|                            |drepper.fsp at gmail dot
                   |                            |com
         Resolution|                            |FIXED

--- Comment #7 from Ulrich Drepper <drepper.fsp at gmail dot com> 2010-11-22 16:17:55 UTC ---
I added a slightly modified version of the patch.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug nis/10085] nss_compat cannot handle split groups in NIS for initgroups()

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=10085

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug nis/10085] nss_compat cannot handle split groups in NIS for initgroups()

[pasky at suse dot cz]

------- Additional Comments From pasky at suse dot cz  2010-05-31 21:02 -------
Created an attachment (id=4824)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=4824&action=view)
proposed patch

This is a simple patch that makes sure skip_initgroups_dyn is set only in case
initgroups is not available; it also attempts to handle the unavailability of
other NSS interfaces better.

I think it would be better to simply always require setgrent() to be available
when initgroups() isn't, since the getgrent_next is never going to work
properly without it anyway. Also, in case of the multi-entry fallback, we do
not make sure getgrent is available - I'm not sure how to handle this properly,
but it seems to me that the best solution would be again to require the NIS NSS
module to always provide all the important interfaces. Is there a reason why
the current code attempts to handle NIS NSS that does not provide some of the
interfaces?

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=10085

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug nis/10085] nss_compat cannot handle split groups in NIS for initgroups()

[pasky at suse dot cz]

------- Additional Comments From pasky at suse dot cz  2010-05-31 20:53 -------
Unfortunately, currently compat initgroups() is completely broken; the code will
always set skip_initgroups_dyn to true, so initgroups() will never be actually
called, but due to the nature of the code, setgrent() won't be called either -
thus, subsequent invocations of initgroups() will not return the NIS group list
anymore.

I will attach a patch shortly.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |


http://sourceware.org/bugzilla/show_bug.cgi?id=10085

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug nis/10085] nss_compat cannot handle split groups in NIS for initgroups()

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2009-06-21 03:43 -------
The patch is really no good idea.  Introducing a boolean for that isn't
necessary.  We can recognize the situation and automatically switch to the slow
mode.   This is made more acceptable by the additional optimization I
implemented to not perform any additional tests if there is no blacklist.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=10085

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug nis/10085] nss_compat cannot handle split groups in NIS for initgroups()

[pasky at suse dot cz]

------- Additional Comments From pasky at suse dot cz  2009-04-27 13:34 -------
I have:

nistest2:x:1236:nistesta,nistestb
nistest2b:x:1236:nistestc

Then:

pixie:/var/yp # id nistesta
uid=1235(nistesta) gid=1234(nistest) groups=1234(nistest)
pixie:/var/yp # id nistestb
uid=1236(nistestb) gid=1234(nistest) groups=1234(nistest)
pixie:/var/yp # id nistestc
uid=1237(nistestc) gid=1234(nistest) groups=1234(nistest),1236(nistest2b)

So this does trigger for me. :( And I really can't see how this could work with
the code... Do you have

group:  compat

in /etc/nsswitch.conf? (It works fine with 'files nis').

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW


http://sourceware.org/bugzilla/show_bug.cgi?id=10085

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug nis/10085] nss_compat cannot handle split groups in NIS for initgroups()

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2009-04-20 03:13 -------
You have to describe the problem, or more correctly how to reproduce it.  I added 

testgr1:x:2000:foo
testgr2:x:2000:bar

to the NIS database and getgrouplist() for both foo and bar includes 2000.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |WAITING


http://sourceware.org/bugzilla/show_bug.cgi?id=10085

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug nis/10085] nss_compat cannot handle split groups in NIS for initgroups()

[pasky at suse dot cz]

------- Additional Comments From pasky at suse dot cz  2009-04-19 21:53 -------
Created an attachment (id=3894)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=3894&action=view)
Proposed patch


-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=10085

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.