[Bug 1307778] Re: getent group on trusty returns only local groups
Ezra Van Everbroeck
ezra at ucsd.edu
Wed Apr 30 22:08:13 UTC 2014
Just to add a few data points, we've been running Winbind for years to
use accounts from our university's domain. We don't have Domain Admin
access though so a lot of accounts belong to AD groups out of our
control and that we can't assign GIDs to. This has never been an issue
because Winbind would not report membership in such groups to Linux.
Compare the output of Ubuntu 12.04 and 14.04 for the same account:
### 12.04 + winbind 2:3.6.3-2ubuntu2.10
truffle:~$ groups mhatrak
mhatrak : domain users ling-mayberrylab BUILTIN\users
truffle:~$ id mhatrak
uid=100051358(mhatrak) gid=513(domain users) groups=513(domain users),1310022(ling-mayberrylab),287(BUILTIN\users)
### 14.04 + winbind 2:4.1.6+dfsg-1ubuntu2
enoki:~$groups mhatrak
mhatrak : domain users groups: cannot find name for group ID 4294967295
4294967295 groups: cannot find name for group ID 4294967295
4294967295 ling-mayberrylab libuuid
enoki:~$id mhatrak
uid=100051358(mhatrak) gid=513(domain users) groups=513(domain users),4294967295,4294967295,1310022(ling-
mayberrylab),101(libuuid)
The new behavior breaks sudo because it can't verify all the groups. It may be that this is the only program affected but I haven't done any exhaustive testing.
enoki:~$sudo bash
sudo: unable to set runas group vector: Invalid argument
Interestingly, SSSD works better now. It also reports an error but at least sudo is still functional.
### 14.04 + sssd 1.11.5-1ubuntu3
porcini:~$ groups mhatrak
mhatrak : groups: cannot find name for group ID 1000002
1000002 ling-mayberrylab domain users
porcini:~$ id mhatrak
uid=100051358(mhatrak) gid=1000002 groups=1000002,1310022(ling-mayberrylab),513(domain users)
porcini:~$ sudo bash
porcini:~#
It seems to me the old Winbind behavior is desirable. There's little
point in telling the OS about group membership for groups that are not
going to work due to their lack of a GID. It should be easy to filter
them out automatically or at least provide an option to do so.
--
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to samba in Ubuntu.
https://bugs.launchpad.net/bugs/1307778
Title:
getent group on trusty returns only local groups
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1307778/+subscriptions
More information about the Ubuntu-server-bugs
mailing list