[PATCH]Don't clean up groups for which a user has it as primary GID

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We were cleaning up all groups that were expired and for which
there existed no user with memberOf: <thegroup> as an attribute.

This patch modifies the search to also check for cached users with
this group's GID as their primary GID.

Fixes https://fedorahosted.org/sssd/ticket/624

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkzRS1MACgkQeiVVYja6o6NhtACaA0B8c98/9cHnQFinKl8AomfG
> NFYAoIZx8mHuiigUwrNGREGfuN0p9be2
> =HAhe
> -----END PGP SIGNATURE-----

[Simo Sorce]

On Wed, 03 Nov 2010 07:45:24 -0400
Stephen Gallagher <sgallagh(a)redhat.com&gt; wrote:

>  +         */
>  +        subfilter = talloc_asprintf(tmpctx, "(|(%s=%s)(%s=%u))",
>  +                                    SYSDB_MEMBEROF, dn,
>  +                                    SYSDB_GIDNUM, gid);
>           if (!subfilter) { 
NACK, change the filter to use %lu and cast gid to (long unsigned) and
then it is an ack. Although currently an id is an unsigned 32bit
integere it is better to play safe here and do an explicit cast to a
type know to snprintf and big enough to contain the value.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/03/2010 08:23 AM, Simo Sorce wrote:
>  On Wed, 03 Nov 2010 07:45:24 -0400
>  Stephen Gallagher <sgallagh(a)redhat.com&gt; wrote:
>  
> > +         */
> > +        subfilter = talloc_asprintf(tmpctx, "(|(%s=%s)(%s=%u))",
> > +                                    SYSDB_MEMBEROF, dn,
> > +                                    SYSDB_GIDNUM, gid);
> >          if (!subfilter) {
>  
>  NACK, change the filter to use %lu and cast gid to (long unsigned) and
>  then it is an ack. Although currently an id is an unsigned 32bit
>  integere it is better to play safe here and do an explicit cast to a
>  type know to snprintf and big enough to contain the value. 
Good catch, thanks.

New patch attached.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkzRVdcACgkQeiVVYja6o6PSkQCfZMQkH8z/EfADTqr6CqbvUZC4
> fFAAoJunHcHiAE58qqtspMH5XHyz/QRF
> =AAt1
> -----END PGP SIGNATURE-----

[Simo Sorce]

On Wed, 03 Nov 2010 08:30:15 -0400
Stephen Gallagher <sgallagh(a)redhat.com&gt; wrote:

>  > NACK, change the filter to use %lu and cast gid to (long
> unsigned)
>  > and then it is an ack. Although currently an id is an unsigned 32bit
>  > integere it is better to play safe here and do an explicit cast to a
>  > type know to snprintf and big enough to contain the value.  
>  
>  Good catch, thanks.
>  
>  New patch attached. 
ACK.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

[Stephen Gallagher]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/03/2010 08:42 AM, Simo Sorce wrote:
>  On Wed, 03 Nov 2010 08:30:15 -0400
>  Stephen Gallagher <sgallagh(a)redhat.com&gt; wrote:
>  
> >> NACK, change the filter to use %lu and cast gid to (long unsigned)
> >> and then it is an ack. Although currently an id is an unsigned 32bit
> >> integere it is better to play safe here and do an explicit cast to a
> >> type know to snprintf and big enough to contain the value.  
> >
> > Good catch, thanks.
> >
> > New patch attached.
>  
>  ACK. 

Pushed to master.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkzSueMACgkQeiVVYja6o6NcNQCfcBWoUnc3XVIV0YfNDOtRRayB
> t9cAnR3H9wZMGv0YSpV42WqzuikHMiCq
> =aKwW
> -----END PGP SIGNATURE-----