Bug 6415 - "idmap backend = tdb" does not filter out of range id mappings
Summary: "idmap backend = tdb" does not filter out of range id mappings
Alias: None
Product: Samba 3.3
Classification: Unclassified
Component: Winbind (show other bugs)
Version: 3.3.4
Hardware: Other Linux
: P3 normal
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
Depends on:
Reported: 2009-05-27 12:07 UTC by Michael Adam
Modified: 2009-07-29 07:45 UTC (History)
2 users (show)

See Also:
vl: review+

fix for v3-3-test (3.27 KB, patch)
2009-05-27 18:33 UTC, Michael Adam
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Adam 2009-05-27 12:07:28 UTC
The ranges set by idmap uid and idmap gid are used as the allocation range for the unixid-allocator, but for the default idmap config, they are not used as a mapping filter.

This has the effect that mappings that are present in the winbindd_idmap.tdb database but are not within the configured range, are returned by the sids_to_unixids call.

an example how to reproduce:
(this uses registry config but this is just for convenience, irrelevant for the bug)

$ net conf getparm global "idmap gid"
$ winbindd
$ wbinfo -Y S-1-5-21-198380148-81607542-3125035400-1102
$ killall winbindd
$ net cache flush
$ net conf setparm global "idmap gid" 20000-20010
$ winbindd
$ wbinfo -Y S-1-5-21-198380148-81607542-3125035400-1102

This bug was introduced in 3.3.0.
Idmap config of catchall default domains was different before 3.3

Comment 1 Michael Adam 2009-05-27 12:51:47 UTC
fix pushed to master
Comment 2 Michael Adam 2009-05-27 17:56:35 UTC
pushed to v3-4-test
Comment 3 Michael Adam 2009-05-27 18:33:50 UTC
Created attachment 4215 [details]
fix for v3-3-test

please review
Comment 4 Volker Lendecke 2009-05-28 08:50:38 UTC
I'm not 100% certain I would call this a bug. Changing a configuration and leaving the idmap database unchanged is really begging for trouble. Yes, it might be a change in behavior between 3.2 and 3.3, but I'm not certain which of both is buggier than the other.

Comment 5 Volker Lendecke 2009-05-28 09:01:44 UTC
Ok, I got convinced this is a bug that needs fixing. Karolin, please put this into 3.3.


Comment 6 Karolin Seeger 2009-05-28 09:10:18 UTC
Pushed, will be in 3.3.5.