#22 Problem with volume sgrp and winbind

pam_mount
closed-fixed
pam_mount (94)
5
2008-06-19
2008-05-27
No

I'm using pam_mount to automount some windows shares whenever a user logs in.

I'm using winbind with "winbind use default domain = true", so users can log in using "user" as user name (in addition to "DOMAIN\user"). However, getgrent returns only "DOMAIN\user" as member names in gr_mem.

The attached patch, which I'm using successfully, adds another method to determine user group membership in user_in_sgrp. Namely, it uses getgrouplist to enumerate the groups a user belongs to. This is the same method id(1) uses to list groups.

Discussion

  • Thomas Sailer

    Thomas Sailer - 2008-05-27

    pam_mount patch to work with winbind.

     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-09
    • assigned_to: nobody --> jengelh
    • milestone: --> pam_mount
    • labels: --> pam_mount
    • status: open --> open-accepted
     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-10
    • status: open-accepted --> pending-accepted
     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-10

    Logged In: YES
    user_id=1287009
    Originator: NO

    pam_mount already does a relookup on the user (function "relookup_user") to make it work with the case-insensitivity of MSAD usernames. This relookup will cause pam_mount to deal with "DOMAIN\user" names the rest of the time—at least I think so. Can you test?

     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-11

    Logged In: YES
    user_id=1287009
    Originator: NO

    I'll tag this "Works for me", because relookup_user() will take the username that was inputed and feed it through getpwnam(), and the NSS module that is reponsible for handling it returns a structure with the "re-resolved" name (if it does not: pam_mount can't help it). The reresolved name is passed through the entire pam_mount code, down to user_in_sgrp where it can be compared against the groups.
    Please reopen if this does not hold true for you, can discuss it.

     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-11
    • status: pending-accepted --> closed-works-for-me
     
  • Thomas Sailer

    Thomas Sailer - 2008-06-13

    Logged In: YES
    user_id=976704
    Originator: YES

    It works now for me with pam_mount 0.40. But unfortunately sgrp="xx" does not work anymore, both
    <volume ... sgrp="xx" />
    and
    <volume ...><sgrp>xx</sgrp></volume>
    matches always, regardless of the user being member of that group or not...

     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-13
    • status: closed-works-for-me --> closed-fixed
     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-13

    Logged In: YES
    user_id=1287009
    Originator: NO

    I fixed the sgrp="xx" one, but could not reproduce the <sgrp>xx</sgrp> problem case.

    <volume path="/dev/shm" mountpoint="/tmp/%(USER)"><sgrp>root</sgrp></volume>

    does not get mounted for a normal user.

     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-13

    Logged In: YES
    user_id=1287009
    Originator: NO

    Reproduced #2.

     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-13
    • status: closed-fixed --> open-accepted
     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-13
    • status: open-accepted --> closed-fixed
     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-13

    Logged In: YES
    user_id=1287009
    Originator: NO

    Fixed in 24a224b3.

     
  • Thomas Sailer

    Thomas Sailer - 2008-06-19

    Logged In: YES
    user_id=976704
    Originator: YES

    I've tried 0.41, and sgrp="xx" now indeed works, thanks.

    I'm still having problems with <or><sgrp>XX</sgrp><sgrp>xx</sgrp></or>, as that still matches users who are not members of xx or XX.

     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-19
    • status: closed-fixed --> open-fixed
     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-19
    • status: open-fixed --> closed-fixed
     
  • Jan Engelhardt

    Jan Engelhardt - 2008-06-19

    Logged In: YES
    user_id=1287009
    Originator: NO

    I have already noticed, but only after 0.41. http://tinyurl.com/4nnfcv .

     

Log in to post a comment.