Re: use initgroups_dyn-less nss impls in a thread-safer way

[Roland McGrath <roland at hack dot frob dot com>]

> Sorry, I guess I was too deep in the problem to describe it properly.

Thanks for the explanation.

> Err, do you mean the lack of initgroups_dyn is a bug?  

No, I just didn't understand the details correctly.

> If you ask me, I'd say an ideal API would expose opaque internal nss
> iterators, but that would be an nss interface change that, if not
> mandatory and accompanied by a flag day, would still require a fallback
> like the current compat_call, which IMHO would still call for a fix like
> the one I offered.

I agree.  I agree that a truly thread-safe interface would be superior.
I also agree that we need compatibility with existing nss modules.  

At some point, we should have some way not to need so many fallback
cases for old modules while not breaking things in subtle ways.  (The
obvious thing would be to change the SONAME schema so new modules
exporting the preferred, clean interfaces use a new SONAME.)

So, your change seems reasonable to me given the confluence of cruft
here.  But I really don't know the nss code sufficiently well these days
to feel authoritative.


Thanks,
Roland