Bug 9446 - id mapping code delivers inconsistent results
Summary: id mapping code delivers inconsistent results
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.0
Classification: Unclassified
Component: Winbind (show other bugs)
Version: 4.0.0rc5
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-12-03 09:56 UTC by Michael Adam
Modified: 2012-12-03 19:27 UTC (History)
2 users (show)

See Also:


Attachments
Patches for v4-0-test (118.31 KB, patch)
2012-12-03 10:20 UTC, Stefan Metzmacher
obnox: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Adam 2012-12-03 09:56:39 UTC
current ID-Mapping code produces inconsistent results under various circumstances:

1.
The rid and autorid modules (or more generally any module that is purely algorithmic and create mappings in both directions), return different results depending on whether the cache is filled or not filled with corresponding entries.

The reason is that the cache (and backends like TDB) do care about the type of a mapping. The sid_to_unixid code asks for the type of a sid before going into the id mapping code.

But if for instance a number is given to the uid-to-sid call with a rid backend, that is mapped to a sid, no matter what the type of the resulting sid would be (or if it even existed). If the sid happens to be a group sid, the cache is primed with a sid2uid mapping for this sid, and a following sid2gid call for that sid (or a gid2sid for that gid) fails. After a "net cache flush", the sid2gid and gid2sid calls would succeed.

2.
There are singular and plural calls into id mapping (sid_to_uid,sid_to_gid, sids_to_unix_ids). The singular calls call singular backend functions on the winbindd parent-child-pipe. The plural call calls a plural variant. These behave slightly differently. For example, they hand different sets of sids to the passdb idmap backend. E.g. the builtin\\administrators group will get different sids when resolved via singluar or plural.
Comment 1 Michael Adam 2012-12-03 10:04:05 UTC
The patch for this bug is to

1. only use one code path into id mapping (the sids2xids one)
2. to fix what sids are handed to the passdb backend
3. to teach the rid and autorid modules to return mappings of type BOTH and teach the sids2xids code to interpret the more generous types correctly.

Michael
Comment 2 Stefan Metzmacher 2012-12-03 10:20:30 UTC
Created attachment 8258 [details]
Patches for v4-0-test
Comment 3 Michael Adam 2012-12-03 11:26:47 UTC
Comment on attachment 8258 [details]
Patches for v4-0-test

ACK
Comment 4 Michael Adam 2012-12-03 11:27:26 UTC
==> Karolin for 4.0
Comment 5 Karolin Seeger 2012-12-03 12:19:58 UTC
Pushed to autobuild-v4-0-test.
Comment 6 Karolin Seeger 2012-12-03 19:27:42 UTC
Pushed to v4-0-test.
Closing out bug report.

Thanks!