Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SSSD user/group filtering is failing after "files" provider rebuilds cache #1024

Closed
alexey-tikhonov opened this issue Apr 17, 2020 · 2 comments
Closed

SSSD user/group filtering is failing after "files" provider rebuilds cache #1024

alexey-tikhonov opened this issue Apr 17, 2020 · 2 comments
Assignees
@alexey-tikhonov
Labels
Bugzilla Closed: Fixed Issue was closed as fixed.

Comments

@alexey-tikhonov
Copy link
Member

alexey-tikhonov commented Apr 17, 2020 •
edited

Steps to Reproduce:

[nss]
filter_groups = root
filter_users = root, admin

$ id admin
id: ‘admin’: no such user
-- as expected, user 'admin' is filtered out

$ adduser test

$ id admin
uid=1389800000(admin) gid=1389800000(admins) groups=1389800000(admins)
-- user is not filtered anymore.

Initially reported as: https://bugzilla.redhat.com/show_bug.cgi?id=1824323
@alexey-tikhonov
Copy link
Member Author

Files provider sets up inotify_init1() on /etc/passwd and /etc/group.

When those files are updated appropriate callback is run:

sf_passwd_cb -> dp_sbus_reset_users_ncache() -> sbus_call_resp_negcache_ResetUsers_send() -> sbuds method ("sssd.Responder.NegativeCache", "ResetUsers") -> sss_resp_reset_ncache_users() -> sss_ncache_reset_users() -> sss_ncache_reset_pfx() -- this deletes everything, including permanent entries.

The same with 'group'.

Easy solution is to leave permanent entries intact (to skip).
More sophisticated and potentially fruitful approach would be to reset from neg cache only entries that were updated in files.

@alexey-tikhonov alexey-tikhonov self-assigned this Apr 20, 2020
alexey-tikhonov added a commit to alexey-tikhonov/sssd that referenced this issue Jun 16, 2020
@alexey-tikhonov
NEGCACHE: skip permanent entries in [users/groups] reset
4e4a2bb 
Files provider calling `sss_ncache_reset_[users/groups]()`
during cache rebuilding was breaking neg-cache prepopulation.

Resolves: SSSD#1024
@alexey-tikhonov alexey-tikhonov mentioned this issue Jun 16, 2020
Closed
@pbrezina
Copy link
Member

Pushed PR: #5208

  • master
    • 88e9296 - NEGCACHE: skip permanent entries in [users/groups] reset

@pbrezina pbrezina added the Closed: Fixed Issue was closed as fixed. label Jun 24, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@alexey-tikhonov alexey-tikhonov

Labels
Bugzilla Closed: Fixed Issue was closed as fixed.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

NEGCACHE: skip permanent entries in [users/groups] reset alexey-tikhonov/sssd
2 participants
@pbrezina @alexey-tikhonov