emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity
51e77b9a96
shadow/lib/sssd.c

76 lines
1.9 KiB
C
Raw Normal View History

Flush sssd caches in addition to nscd caches Some distributions, notably Fedora, have the following order of nsswitch modules by default: passwd: sss files group: sss files The advantage of serving local users through SSSD is that the nss_sss module has a fast mmapped-cache that speeds up NSS lookups compared to accessing the disk an opening the files on each NSS request. Traditionally, this has been done with the help of nscd, but using nscd in parallel with sssd is cumbersome, as both SSSD and nscd use their own independent caching, so using nscd in setups where sssd is also serving users from some remote domain (LDAP, AD, ...) can result in a bit of unpredictability. More details about why Fedora chose to use sss before files can be found on e.g.: https://fedoraproject.org//wiki/Changes/SSSDCacheForLocalUsers or: https://docs.pagure.org/SSSD.sssd/design_pages/files_provider.html Now, even though sssd watches the passwd and group files with the help of inotify, there can still be a small window where someone requests a user or a group, finds that it doesn't exist, adds the entry and checks again. Without some support in shadow-utils that would explicitly drop the sssd caches, the inotify watch can fire a little late, so a combination of commands like this: getent passwd user || useradd user; getent passwd user can result in the second getent passwd not finding the newly added user as the racy behaviour might still return the cached negative hit from the first getent passwd. This patch more or less copies the already existing support that shadow-utils had for dropping nscd caches, except using the "sss_cache" tool that sssd ships.
2018-09-12 17:52:11 +05:30
/* Author: Peter Vrabec <pvrabec@redhat.com> */
#include <config.h>
#ifdef USE_SSSD
#include <stdio.h>
#include <sys/wait.h>
#include <sys/types.h>
#include "exitcodes.h"
#include "defines.h"
#include "prototypes.h"
#include "sssd.h"
Make shadow_logfd and Prog not extern Closes #444 Closes #465 Signed-off-by: Serge Hallyn <serge@hallyn.com>
2021-11-29 05:07:53 +05:30
#include "shadowlog_internal.h"
lib/sssd: redirect warning message to file Instead of printing warning in stderr print it to file. This way the user is not spammed with unnecessary messages when updating packages. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1749001
2020-10-02 19:39:42 +05:30
#define MSG_SSSD_FLUSH_CACHE_FAILED "%s: Failed to flush the sssd cache."
Flush sssd caches in addition to nscd caches Some distributions, notably Fedora, have the following order of nsswitch modules by default: passwd: sss files group: sss files The advantage of serving local users through SSSD is that the nss_sss module has a fast mmapped-cache that speeds up NSS lookups compared to accessing the disk an opening the files on each NSS request. Traditionally, this has been done with the help of nscd, but using nscd in parallel with sssd is cumbersome, as both SSSD and nscd use their own independent caching, so using nscd in setups where sssd is also serving users from some remote domain (LDAP, AD, ...) can result in a bit of unpredictability. More details about why Fedora chose to use sss before files can be found on e.g.: https://fedoraproject.org//wiki/Changes/SSSDCacheForLocalUsers or: https://docs.pagure.org/SSSD.sssd/design_pages/files_provider.html Now, even though sssd watches the passwd and group files with the help of inotify, there can still be a small window where someone requests a user or a group, finds that it doesn't exist, adds the entry and checks again. Without some support in shadow-utils that would explicitly drop the sssd caches, the inotify watch can fire a little late, so a combination of commands like this: getent passwd user || useradd user; getent passwd user can result in the second getent passwd not finding the newly added user as the racy behaviour might still return the cached negative hit from the first getent passwd. This patch more or less copies the already existing support that shadow-utils had for dropping nscd caches, except using the "sss_cache" tool that sssd ships.
2018-09-12 17:52:11 +05:30
int sssd_flush_cache (int dbflags)
{
int status, code, rv;
const char *cmd = "/usr/sbin/sss_cache";
char *sss_cache_args = NULL;
const char *spawnedArgs[] = {"sss_cache", NULL, NULL};
const char *spawnedEnv[] = {NULL};
int i = 0;
sss_cache_args = malloc(4);
if (sss_cache_args == NULL) {
return -1;
}
sss_cache_args[i++] = '-';
if (dbflags & SSSD_DB_PASSWD) {
sss_cache_args[i++] = 'U';
}
if (dbflags & SSSD_DB_GROUP) {
sss_cache_args[i++] = 'G';
}
sss_cache_args[i++] = '\0';
if (i == 2) {
/* Neither passwd nor group, nothing to do */
free(sss_cache_args);
return 0;
}
spawnedArgs[1] = sss_cache_args;
rv = run_command (cmd, spawnedArgs, spawnedEnv, &status);
free(sss_cache_args);
if (rv != 0) {
/* run_command writes its own more detailed message. */
lib: rename Prog to shadow_progname, with only one definition The build was failing with duplicate symbol errors with -fno-common. This is the default in GCC 10 and later, and explicitly enabled in some distributions to catch problems like this. There were two causes: - Prog and shadow_logfd were defined in a header file that was included in multiple other files. Fix this by defining them once in shadowlog.c, and having extern declarations in the header. - Most of the tools (except id/nologin) also define a Prog variable, which is not intended to alias the one in the library. Fix this by renaming Prog in the library to shadow_progname, which also matches the new accessor functions for it.
2021-12-26 04:11:58 +05:30
SYSLOG ((LOG_WARN, MSG_SSSD_FLUSH_CACHE_FAILED, shadow_progname));
Flush sssd caches in addition to nscd caches Some distributions, notably Fedora, have the following order of nsswitch modules by default: passwd: sss files group: sss files The advantage of serving local users through SSSD is that the nss_sss module has a fast mmapped-cache that speeds up NSS lookups compared to accessing the disk an opening the files on each NSS request. Traditionally, this has been done with the help of nscd, but using nscd in parallel with sssd is cumbersome, as both SSSD and nscd use their own independent caching, so using nscd in setups where sssd is also serving users from some remote domain (LDAP, AD, ...) can result in a bit of unpredictability. More details about why Fedora chose to use sss before files can be found on e.g.: https://fedoraproject.org//wiki/Changes/SSSDCacheForLocalUsers or: https://docs.pagure.org/SSSD.sssd/design_pages/files_provider.html Now, even though sssd watches the passwd and group files with the help of inotify, there can still be a small window where someone requests a user or a group, finds that it doesn't exist, adds the entry and checks again. Without some support in shadow-utils that would explicitly drop the sssd caches, the inotify watch can fire a little late, so a combination of commands like this: getent passwd user || useradd user; getent passwd user can result in the second getent passwd not finding the newly added user as the racy behaviour might still return the cached negative hit from the first getent passwd. This patch more or less copies the already existing support that shadow-utils had for dropping nscd caches, except using the "sss_cache" tool that sssd ships.
2018-09-12 17:52:11 +05:30
return -1;
}
code = WEXITSTATUS (status);
if (!WIFEXITED (status)) {
lib/sssd: redirect warning message to file Instead of printing warning in stderr print it to file. This way the user is not spammed with unnecessary messages when updating packages. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1749001
2020-10-02 19:39:42 +05:30
SYSLOG ((LOG_WARN, "%s: sss_cache did not terminate normally (signal %d)",
lib: rename Prog to shadow_progname, with only one definition The build was failing with duplicate symbol errors with -fno-common. This is the default in GCC 10 and later, and explicitly enabled in some distributions to catch problems like this. There were two causes: - Prog and shadow_logfd were defined in a header file that was included in multiple other files. Fix this by defining them once in shadowlog.c, and having extern declarations in the header. - Most of the tools (except id/nologin) also define a Prog variable, which is not intended to alias the one in the library. Fix this by renaming Prog in the library to shadow_progname, which also matches the new accessor functions for it.
2021-12-26 04:11:58 +05:30
shadow_progname, WTERMSIG (status)));
Flush sssd caches in addition to nscd caches Some distributions, notably Fedora, have the following order of nsswitch modules by default: passwd: sss files group: sss files The advantage of serving local users through SSSD is that the nss_sss module has a fast mmapped-cache that speeds up NSS lookups compared to accessing the disk an opening the files on each NSS request. Traditionally, this has been done with the help of nscd, but using nscd in parallel with sssd is cumbersome, as both SSSD and nscd use their own independent caching, so using nscd in setups where sssd is also serving users from some remote domain (LDAP, AD, ...) can result in a bit of unpredictability. More details about why Fedora chose to use sss before files can be found on e.g.: https://fedoraproject.org//wiki/Changes/SSSDCacheForLocalUsers or: https://docs.pagure.org/SSSD.sssd/design_pages/files_provider.html Now, even though sssd watches the passwd and group files with the help of inotify, there can still be a small window where someone requests a user or a group, finds that it doesn't exist, adds the entry and checks again. Without some support in shadow-utils that would explicitly drop the sssd caches, the inotify watch can fire a little late, so a combination of commands like this: getent passwd user || useradd user; getent passwd user can result in the second getent passwd not finding the newly added user as the racy behaviour might still return the cached negative hit from the first getent passwd. This patch more or less copies the already existing support that shadow-utils had for dropping nscd caches, except using the "sss_cache" tool that sssd ships.
2018-09-12 17:52:11 +05:30
return -1;
} else if (code == E_CMD_NOTFOUND) {
/* sss_cache is not installed, or it is installed but uses an
interpreter that is missing. Probably the former. */
return 0;
} else if (code != 0) {
lib: rename Prog to shadow_progname, with only one definition The build was failing with duplicate symbol errors with -fno-common. This is the default in GCC 10 and later, and explicitly enabled in some distributions to catch problems like this. There were two causes: - Prog and shadow_logfd were defined in a header file that was included in multiple other files. Fix this by defining them once in shadowlog.c, and having extern declarations in the header. - Most of the tools (except id/nologin) also define a Prog variable, which is not intended to alias the one in the library. Fix this by renaming Prog in the library to shadow_progname, which also matches the new accessor functions for it.
2021-12-26 04:11:58 +05:30
SYSLOG ((LOG_WARN, "%s: sss_cache exited with status %d", shadow_progname, code));
SYSLOG ((LOG_WARN, MSG_SSSD_FLUSH_CACHE_FAILED, shadow_progname));
Flush sssd caches in addition to nscd caches Some distributions, notably Fedora, have the following order of nsswitch modules by default: passwd: sss files group: sss files The advantage of serving local users through SSSD is that the nss_sss module has a fast mmapped-cache that speeds up NSS lookups compared to accessing the disk an opening the files on each NSS request. Traditionally, this has been done with the help of nscd, but using nscd in parallel with sssd is cumbersome, as both SSSD and nscd use their own independent caching, so using nscd in setups where sssd is also serving users from some remote domain (LDAP, AD, ...) can result in a bit of unpredictability. More details about why Fedora chose to use sss before files can be found on e.g.: https://fedoraproject.org//wiki/Changes/SSSDCacheForLocalUsers or: https://docs.pagure.org/SSSD.sssd/design_pages/files_provider.html Now, even though sssd watches the passwd and group files with the help of inotify, there can still be a small window where someone requests a user or a group, finds that it doesn't exist, adds the entry and checks again. Without some support in shadow-utils that would explicitly drop the sssd caches, the inotify watch can fire a little late, so a combination of commands like this: getent passwd user || useradd user; getent passwd user can result in the second getent passwd not finding the newly added user as the racy behaviour might still return the cached negative hit from the first getent passwd. This patch more or less copies the already existing support that shadow-utils had for dropping nscd caches, except using the "sss_cache" tool that sssd ships.
2018-09-12 17:52:11 +05:30
return -1;
}
return 0;
}
#else /* USE_SSSD */
extern int errno; /* warning: ANSI C forbids an empty source file */
#endif /* USE_SSSD */
Reference in New Issue Copy Permalink