Bug 1063468
| Summary: | Set a higher min_id for IPA provider by default | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Najmuddin Chirammal <nc> |
| Component: | sssd | Assignee: | SSSD Maintainers <sssd-maint> |
| Status: | CLOSED DEFERRED | QA Contact: | Kaushik Banerjee <kbanerje> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | CC: | dpal, grajaiya, jgalipea, jhrozek, lslebodn, mkosek, pbrezina, preichl, tmraz |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-04-24 11:25:00 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1113520 | ||
|
Description
Najmuddin Chirammal
2014-02-10 19:29:29 UTC
The only catch where this wouldn't work is when the POSIX IDs were migrated from LDAP -or- there is a trust setup in place and the trusted AD has POSIX IDs below 1000. Maybe this could be solved with a one-time search after startup, maybe we'll just document the issue. Needs more discussion with the other developers. Also, one possible alternative might be to set a more sensible defaults for "groupadd -r"/"useradd -r". I have no idea why they scan the ID space so aggressively. Tomas, do you know why does shadow-utils first search the whole GID space when adding a system group and only then pick the first unused? Is there a reason to not pick the first unused without scanning the whole ID space? Also when looking at find_new_gid() in shadow-utils, they seem to be using getgrent() for non-system groups. That's not going to work with sssd at all by default, we don't support group enumeration with the default settings. (In reply to Jakub Hrozek from comment #3) > Tomas, do you know why does shadow-utils first search the whole GID space > when adding a system group and only then pick the first unused? Is there a > reason to not pick the first unused without scanning the whole ID space? It scans only the range of system GID space and not the whole ID space. The reason is to lower the possibility of reusing gids of deleted groups (of course if you delete the last group you previously added, this will not work). I think we should keep this behavior as it was established for a long time. > Also when looking at find_new_gid() in shadow-utils, they seem to be using > getgrent() for non-system groups. That's not going to work with sssd at all > by default, we don't support group enumeration with the default settings. It does not matter much as long as the space used by the LDAP groups is sufficiently in high ID numbers. The sysadmin has chance to configure maximum group ID allowed for user groups in /etc/login.defs. The current GID_MAX value is 60000. Upstream ticket: https://fedorahosted.org/sssd/ticket/2238 Thank you taking your time and submitting this request for Red Hat Enterprise Linux. Unfortunately, this bug was not given a priority and was deferred both in the upstream project and in Red Hat Enterprise Linux. Given that we are unable to fulfill this request in following Red Hat Enterprise Linux releases, I am closing the Bugzilla as DEFERRED. To request that Red Hat re-considers the decision, please re-open the Bugzilla via appropriate support channels and provide additional business and/or technical details about its importance to you. Note that you can still track this request or even contribute patches in the referred upstream Trac ticket. |