emo/shadow
1
0
Fork 0
Code Issues Pull Requests Packages Releases Activity
1,944 Commits 1 Branch 1 Tag 20 MiB
Shell 57.1%
C 40.6%
M4 0.9%
Yacc 0.8%
Makefile 0.4%
Other 0.1%
ee9e506af2
Go to file
Tomas Mraz ee9e506af2 Make the group and user allocation more effective. 
Previously, the allocation was optimized for an outdated
deployment style (that of /etc/group alongside nss_db). The issue
here is that this results in extremely poor performance when using
SSSD, Winbind or nss_ldap.

There were actually two serious bugs here that have been addressed:

1) Running getgrent() loops won't work in most SSSD or Winbind
environments, as full group enumeration is disabled by default.
This could easily result in auto-allocating a group that was
already in use. (This might result in a security issue as well, if
the shared GID is a privileged group).

2) For system groups, the loop was always iterating through the
complete SYS_GID_MIN->SYS_GID_MAX range. On SSSD and Winbind, this
means hundreds of round-trips to LDAP (unless the GIDs were
specifically configured to be ignored by the SSSD or winbindd).
To a user with a slow connection to their LDAP server, this would
appear as if groupadd -r was hung. (Though it would eventually
complete).

This patch changes the algorithm to be more favorable for LDAP
environments, at the expense of some performance when using nss_db.
Given that the DB is a local service, this should have a negligible
effect from a user's perspective.

With the new algorithm, we simply first iterate through all entries
in the local database with gr_next(), recording the IDs that are in
use. We then start from the highest presumed-available entry and
call getgrgid() to see if it is available. We continue this until
we come to the first unused GID. We then select that and return it.

If we make it through all the remaining IDs without finding a free
one, we start over from the beginning of the range and try to find
room in one of the gaps in the range.

The patch was originally written by Stephen Gallagher and applied
identically also to the user allocation by Tomáš Mráz.

Signed-off-by: Serge Hallyn <serge@hallyn.com>
2017-01-29 14:37:21 -06:00
contrib * contrib/adduser-old.c, contrib/adduser.c: Do not use the target 2009-03-07 16:32:11 +00:00
doc Removed DONE entry. 2009-04-10 22:35:19 +00:00
etc Tweak uid/gid map default configuration 2016-02-15 18:11:10 -05:00
lib Update _COMMONIO_H and _SHADOWIO_H to drop leading underscore 2016-12-21 12:45:50 -06:00
libmisc Make the group and user allocation more effective. 2017-01-29 14:37:21 -06:00
man Merge pull request #55 from glensc/travis2 2016-12-06 23:27:19 -06:00
po Revert "Add files via upload" 2016-12-06 23:31:58 -06:00
src Merge pull request #58 from juiceme/master 2016-12-21 12:41:39 -06:00
tests Test userdel/usermod when homedir is a symlink 2014-09-21 00:36:24 +02:00
.gitignore ignore config.cache & dist files 2016-12-05 15:48:10 -05:00
.travis.yml run travis 2016-12-06 01:09:17 +02:00
acinclude.m4 [svn-upgrade] Integrating new upstream version, shadow (4.0.13) 2007-10-07 11:47:01 +00:00
autogen.sh * autogen.sh: Restore original autoreconf (see 2010-08-29's change 2011-02-12 14:57:37 +00:00
ChangeLog Update changelog 2016-12-21 12:58:05 -06:00
configure.ac enable silent build output by default 2016-12-05 16:02:55 -05:00
COPYING Added the subversion svn:keywords property (Id) for proper identification. 2007-11-10 23:46:11 +00:00
Makefile.am switch bz2 dist to xz 2016-12-05 15:57:34 -05:00
NEWS Add NEWS entries. 2013-08-04 23:29:06 +02:00
README Update README with current maintainer 2016-11-02 09:30:05 +01:00
shadow.spec.in * shadow.spec.in: Fix the source (new FTP). 2008-08-31 17:30:45 +00:00
TODO New entry for vipw. 2012-01-15 21:26:56 +00:00

README 

Shadow SITES
============

Homepage
	http://pkg-shadow.alioth.debian.org/

FTP site
	ftp://pkg-shadow.alioth.debian.org/pub/pkg-shadow

SVN repository
	anonymous read only access: svn://svn.debian.org/pkg-shadow/upstream

SVN web interface
	http://svn.debian.org/wsvn/pkg-shadow/upstream
	or
	http://svn.debian.org/viewsvn/pkg-shadow/upstream

Mailing lists
	for general discuss: pkg-shadow-devel@lists.alioth.debian.org
	commit list: pkg-shadow-commits@lists.alioth.debian.org

Mailing lists subscription
	http://lists.alioth.debian.org/mailman/listinfo/pkg-shadow-devel
	http://lists.alioth.debian.org/mailman/listinfo/pkg-shadow-commits

Mailing lists archives:
	http://lists.alioth.debian.org/pipermail/pkg-shadow-devel/
	http://lists.alioth.debian.org/pipermail/pkg-shadow-commits/

S/Key support:
	Shadow can be built with S/Key support using the S/Key package from:

	http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libskey/
	or
	http://gentoo.osuosl.org/distfiles/skey-1.1.5.tar.bz2

Authors and contributors
========================

Thanks to at least the following people for sending patches, bug
reports and various comments.  This list may be incomplete, I received
a lot of mail...


Adam Rudnicki <adam@v-lo.krakow.pl>
Alan Curry <pacman@tardis.mars.net>
Alexander O. Yuriev <alex@bach.cis.temple.edu>
Algis Rudys <arudys@rice.edu>
Andreas Jaeger <aj@arthur.rhein-neckar.de>
Aniello Del Sorbo <anidel@edu-gw.dia.unisa.it>
Anton Gluck <gluc@midway.uchicago.edu>
Arkadiusz Miskiewicz <misiek@pld.org.pl>
Ben Collins <bcollins@debian.org>
Brian R. Gaeke <brg@dgate.org>
Calle Karlsson <ckn@kash.se>
Chip Rosenthal <chip@unicom.com>
Chris Evans <lady0110@sable.ox.ac.uk>
Cristian Gafton <gafton@sorosis.ro>
Dan Walsh <dwalsh@redhat.com>
Darcy Boese <possum@chardonnay.niagara.com>
Dave Hagewood <admin@arrowweb.com>
David A. Holland <dholland@hcs.harvard.edu>
David Frey <David.Frey@lugs.ch>
Ed Carp <ecarp@netcom.com>
Floody <flood@evcom.net>
Frank Denis <j@4u.net>
George Kraft IV <gk4@us.ibm.com>
Greg Mortensen <loki@world.std.com>
Guido van Rooij
Guy Maor <maor@debian.org>
Hrvoje Dogan <hdogan@bjesomar.srce.hr>
Jakub Hrozek <jhrozek@redhat.com>
Janos Farkas <chexum@bankinf.banki.hu>
Jay Soffian <jay@lw.net>
Jesse Thilo <Jesse.Thilo@pobox.com>
Joey Hess <joey@kite.ml.org>
John Adelsberger <jja@umr.edu>
Jonathan Hankins <jhankins@mailserv.homewood.k12.al.us>
Jon Lewis <jlewis@lewis.org>
Joshua Cowan <jcowan@hermit.reslife.okstate.edu>
Judd Bourgeois <shagboy@bluesky.net>
Juergen Heinzl <unicorn@noris.net>
Juha Virtanen <jiivee@iki.fi>
Julian Pidancet <julian.pidancet@gmail.com>
Julianne Frances Haugh <jockgrrl@ix.netcom.com>
Leonard N. Zubkoff <lnz@dandelion.com>
Luca Berra <bluca@www.polimi.it>
Lukáš Kuklínek <lkukline@redhat.com>
Lutz Schwalowsky <schwalow@mineralogie.uni-hamburg.de>
Marc Ewing <marc@redhat.com>
Martin Bene <mb@sime.com>
Martin Mares <mj@gts.cz>
Michael Meskes <meskes@topsystem.de>
Michael Talbot-Wilson <mike@calypso.bns.com.au>
Mike Frysinger <vapier@gentoo.org>
Mike Pakovic <mpakovic@users.southeast.net>
Nicolas François <nicolas.francois@centraliens.net>
Nikos Mavroyanopoulos <nmav@i-net.paiko.gr>
Pavel Machek <pavel@bug.ucw.cz>
Peter Vrabec <pvrabec@redhat.com>
Phillip Street
Rafał Maszkowski <rzm@icm.edu.pl>
Rani Chouha <ranibey@smartec.com>
Sami Kerola <kerolasa@rocketmail.com>
Scott Garman <scott.a.garman@intel.com>
Sebastian Rick Rijkers <srrijkers@gmail.com>
Seraphim Mellos <mellos@ceid.upatras.gr>
Shane Watts <shane@nexus.mlckew.edu.au>
Steve M. Robbins <steve@nyongwa.montreal.qc.ca>
Thorsten Kukuk <kukuk@suse.de>
Tim Hockin <thockin@eagle.ais.net>
Timo Karjalainen <timok@iki.fi>
Ulisses Alonso Camaro <ulisses@pusa.eleinf.uv.es>
Werner Fink <werner@suse.de>

Maintainers
===========

Tomasz Kłoczko <kloczek@pld.org.pl> (2000-2007)
Nicolas François <nicolas.francois@centraliens.net> (2007-2014)
Serge E. Hallyn <serge@hallyn.com> (2014-now)