Feature #3163


nss: need local netgroup implementation

Added by Vitaliy Gusev almost 11 years ago. Updated almost 2 years ago.

lib - userland libraries
Start date:
Due date:
% Done:


Estimated time:
Gerrit CR:
External Bug:


/etc/netgroup now is only for NIS-server, but it also could be used for non-NIS purposes. doesn't have parser for that, so it should be implemented.

Related issues

Related to illumos gate - Bug #13944: nsswitch getnetgrent.c build has reset CERRWARN and SMATCHClosedToomas Soome

Actions #1

Updated by Vitaliy Gusev almost 11 years ago

  • Assignee set to Vitaliy Gusev
Actions #2

Updated by Vitaliy Gusev almost 11 years ago

instead of set:

zfs sharenfs="ro=host1,host2,...,host1024" dataset

can be used next:

netgroup_rohosts    (host1,,) (host2,,) ... (host1024,,)
zfs sharenfs="ro=netgroup_rohosts" dataset
Actions #3

Updated by Gordon Ross about 6 years ago

There's an implementation of this in NexentaStor, in case anyone wants to upstream it.

Actions #4

Updated by Lee Damon almost 2 years ago

This would be very helpful.

Right now I have several NFS exports that go to every host in my site (home directories, etc). The list is too long to be used in a zfs -o sharenfs command. (Plus, having to reset sharenfs every time a host is added means errors are likely to be made). it would be quite useful to have netgroups deal with this. Right now the only way to do that is to run NIS which is a non-starter. Instead I have a shell script that re-exports every directory every time something changes. The resulting mix of /etc/dfs/dfstab and zfs sharenfs is fragile and non-optimal.

Ideally, I'd just export those filesystems to a netgroup (via zfs sharenfs) then just update /etc/netgroups when new hosts are added.

Actions #5

Updated by Andy Fiddaman almost 2 years ago

  • Tracker changed from Bug to Feature
  • Category set to lib - userland libraries
  • Status changed from New to In Progress
  • Assignee changed from Vitaliy Gusev to Andy Fiddaman
  • Start date changed from 2012-09-06 to 2021-06-17
  • Tags deleted (needs-triage)
Actions #6

Updated by Electric Monk almost 2 years ago

  • Gerrit CR set to 1553
Actions #7

Updated by Marco van Wieringen almost 2 years ago

Imported the mentioned code into Omnios bloody and with the help of Andy Fiddaman did some cleanups.

Also did some initial testing given I have LDAP netgroups already tested the combination of local /etc/netgroup and
LDAP netgroups.

> getent netgroup test staff                                                                                                                                                                                                                                               
test \
staff \
    (,mvw,) \
    (,ed,) \
    (,luc,) \

Also tested the nsstest programs.

Actions #8

Updated by Marco van Wieringen almost 2 years ago

Testing with the newest version again with local /etc/netgroup and LDAP.

22:23 [mvw:europa][4] /build/illumos-gate > getent netgroup test                                                                                                                                                                                                                                                            
test (,test,)
22:23 [mvw:europa][5] /build/illumos-gate > getent netgroup staff                                                                                                                                                                                                                                                           
staff (,mvw,) (,ed,) (,luc,) (,smvw,)
22:23 [mvw:europa][6] /build/illumos-gate > getent netgroup staff \* mvw \*                                                                                                                                                                                                                                                 
staff                 (*,mvw,*) = 1

Things now mimic Solaris 11.4 which borrowed the ideas from Linux regarding the 4 key
getent netgroup syntax. Linux even has a typo in the man page as it lets you believe you
can use getent netgroup and then 3 keys but things only work with 4 e.g. netgroupname, host, user and domainname.

The output from getent netgroup is now analog to Linux and Solaris 11.4 the previous output was the way FreeBSD gives output.

Actions #9

Updated by Electric Monk almost 2 years ago

  • Status changed from In Progress to Closed
  • % Done changed from 0 to 100

git commit 74e12c43fe52f2c30f36e65a4d0fb0e8dfd7068a

commit  74e12c43fe52f2c30f36e65a4d0fb0e8dfd7068a
Author: Gordon Ross <>
Date:   2021-07-06T18:42:09.000Z

    3163 nss: need local netgroup implementation
    Portions contributed by: Marco van Wieringen <>
    Reviewed by: Andy Fiddaman <>
    Reviewed by: Peter Tribble <>
    Reviewed by: Toomas Soome <>
    Approved by: Robert Mustacchi <>

Actions #10

Updated by Toomas Soome almost 2 years ago

  • Related to Bug #13944: nsswitch getnetgrent.c build has reset CERRWARN and SMATCH added

Also available in: Atom PDF