Bug 751461

Summary: large groups using db auth don't appear to be added to user
Product: Red Hat Enterprise Linux 6 Reporter: Kevin Fenzi <kevin>
Component: nss_dbAssignee: Nalin Dahyabhai <nalin>
Status: CLOSED CURRENTRELEASE QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 6.1CC: a.badger, aoliva, cww, dpal, ksrot, mfranc, msvoboda, omoris, prc, rdassen, syeghiay
Target Milestone: rcKeywords: Patch, Regression, ZStream
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: nss_db-2.2.3-0.5.pre1.el6 Doc Type: Bug Fix
Doc Text:
The previous update of nss_db attempted to fix a bug, which under certain circumstances prevented multi-threaded applications from obtaining complete lists of user's supplemental group memberships. This problem was not completely fixed due to an internal error that occurred when using an insufficiently large temporary buffer to parse a group entry with a large list of users. This update resolves the issue by resetting the buffer's contents after the buffer has been resized. Large group lists are thus correctly parsed and the entire list of user's supplemental groups is now correctly listed in this scenario.
 Story Points: ---
Clone Of:
: 1174702 (view as bug list) Environment:
Last Closed: 2012-10-09 12:44:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 788668    
Attachments:
Description Flags
proposed patch none

Description Kevin Fenzi 2011-11-04 19:45:31 UTC 
We use: 

group:      db files

in /etc/nsswitch.conf

We have a group that has 5130 uses in it. This group isn't added to users who login that are in the group. 
You can 'newgrp groupname' and it works. It also works if you add it to local /etc/groups, but by default users don't show that group in id or groups, and can't otherwise use those groups.
Comment 1 Toshio Ernie Kuratomi 2011-11-04 19:51:40 UTC 
The next largest group is 4798 users (a subset of the 5130 user group).  This group is currently being added to users' groups properly.
Comment 3 RHEL Program Management 2011-11-08 06:47:17 UTC 
Since RHEL 6.2 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.
Comment 4 Alexandre Oliva 2012-01-13 11:39:27 UTC 
I've just tested a group with 8K+ members with glibc 2.15-ish, that has nss db support built in, and it worked fine; as of glibc 2.12, this was not built in, and it was the separate component nss_db that provided this feature.  Reassigning to the correct component.
Comment 5 Nalin Dahyabhai 2012-01-18 22:42:13 UTC 
Created attachment 556127 [details]
proposed patch
Comment 7 J.H.M. Dassen (Ray) 2012-02-06 16:41:06 UTC 
*** Bug 787382 has been marked as a duplicate of this bug. ***
Comment 12 RHEL Program Management 2012-02-08 07:03:04 UTC 
This request was evaluated by Red Hat Product Management for inclusion
in a Red Hat Enterprise Linux maintenance release. Product Management has 
requested further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed 
products. This request is not yet committed for inclusion in an Update release.
Comment 16 Miroslav Svoboda 2012-02-27 15:27:10 UTC 
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
The previous update of nss_db attempted to fix a bug, which under certain circumstances prevented multi-threaded applications from obtaining complete lists of user's supplemental group memberships. This problem was not completely fixed due to an internal error that occurred when using an insufficiently large temporary buffer to parse a group entry with a large list of users. This update resolves the issue by resetting the buffer's contents after the buffer has been resized. Large group lists are thus correctly parsed and the entire list of user's supplemental groups is now correctly listed in this scenario.
Comment 17 Jiri Pallich 2012-10-09 12:44:05 UTC 
Since this is a parent bug of an issue that has already been released via Z-Stream (e.g. rhel-6.3.z), this bug is going to be CLOSED as CURRENTRELEASE.
Comment 18 Nalin Dahyabhai 2012-10-09 14:31:35 UTC 
This bug was open to ensure that the fix would be included if we should update the package in a Y stream.  I don't believe that it should have been closed.