Subject: Re: SU_INDIRECT_GROUP
To: Simon J. Gerraty <sjg@quick.com.au>
From: Alan Barrett <apb@cequrux.com>
List: tech-security
Date: 01/18/2001 10:00:41
On Wed, 17 Jan 2001, Simon J. Gerraty wrote:
> In the case of the target user, obviously it would stop searching as soon
> as the name matches and thus would not lookup a group name.  
> In other cases, how would su know?  

getpwnam() will tell you whether a text string is a valid user name.  If
it is a valid user name, then don't try to recurse into it as a group
name.

But perhaps that's too expensive, in which case the documentation
should warn people not to expect it to work.

--apb (Alan Barrett)