sysdb: preserve memberships when renaming verified groups - #9050
Open
karlg100 wants to merge 4 commits into
Open
sysdb: preserve memberships when renaming verified groups#9050karlg100 wants to merge 4 commits into
karlg100 wants to merge 4 commits into
Conversation
A raw LDB rename changes the entry DN but leaves member and memberOf values that refer to the old DN. That disconnects otherwise valid direct and transitive membership edges. Add a rename handler that finds references to the old DN, forwards the rename, then replaces only the affected member and memberOf values while preserving controls and response data. Dependency: none. This is independently useful and is required before the same-GID sysdb rename change. Related: SSSD#9049
The rename reference search accumulates an unbounded number of matching entries. Keep its counters in size_t and reject growth at SIZE_MAX before computing num_entries + 1 for talloc_realloc(). This prevents integer wrap from turning a large result count into an undersized allocation followed by an out-of-bounds write. Dependency: memberof rename support from the preceding patch.
When a group arrives under a new name with a GID already present in the cache, deleting and recreating the old entry discards membership state and forces expensive reconstruction. Treat the entry as a rename only when stable identity attributes agree. Prefer SID or UUID, fall back to originalDN, rename the cached DN, remove the stale timestamp-cache key, and then store the incoming attributes. After ldb_rename(), explicitly replace the stored name. Searches in the open transaction can already expose the new RDN and otherwise make the generic no-op comparison suppress this required write. Dependency: memberof rename support, because all member and memberOf references must follow the renamed DN. Related: SSSD#9049
Exercise a same-identity, same-GID group rename while the group is both a child and a parent in a nested graph. Query member and memberOf explicitly, then verify the old name disappears, direct and inherited references use the new DN, and initgroups returns the renamed group without stale membership. Dependencies: memberof rename support and the verified same-GID sysdb rename patches.
karlg100
force-pushed
the
kag/issue-9049-same-gid-rename
branch
from
August 7, 2026 16:51
05bc64a to
cff8a4a
Compare
This was referenced Aug 7, 2026
karlg100
marked this pull request as ready for review
August 7, 2026 19:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When a group arrives under a new name with a GID already present in the
cache, SSSD deletes and recreates the existing group.
If both entries represent the same directory identity, replacement is
unnecessary. Deleting the cached group also causes the memberOf plugin to
synchronously rebuild membership references across the cached graph. With
large or deeply nested membership data, this work can exceed the backend
watchdog deadline and block user logins.
A raw LDB rename is not sufficient because existing
memberandmemberOfvalues continue to reference the old DN.
Solution
memberandmemberOfreferences whenan entry is renamed.
overflow.
group, rename the existing entry instead of deleting and recreating it.
originalDN.under the renamed entry.
membership, and initgroups results.
Scope
This fixes the verified same-GID delete/re-add trigger described in #9049.
It does not include the broader transactional memberOf graph derivation or
the NSS mmap cache-warming optimization. Those changes will be proposed
separately.
Validation
git diff --checkpasses.investigation branches.
completed before the PR is marked ready for review.
Refs #9049