o Add a comment noting that the early setting of privileges for the purpose

  of NFS home directory and root directory processing fails to include
  additional groups.  This doesn't impact the final credential, but does
  mean that users may be denied login even when additional groups might
  allow it.

diff --git a/libutil/login_cap.c b/libutil/login_cap.c
index dc93e2825a2c788ea41a25a5d42a89749c0b278e..85883be82873f577186537a7c7a8d81368e7f933 100644 (file)
--- a/libutil/login_cap.c
+++ b/libutil/login_cap.c
@@ -193,8 +193,12 @@ login_getclassbyname(char const *name, const struct passwd *pwd)
 
        static char *login_dbarray[] = { NULL, NULL, NULL };
 
-       /* Switch to user mode before checking/reading its ~/.login_conf */
-       /* - some NFSes have root read access disabled.                  */
+       /*
+        * Switch to user mode before checking/reading its ~/.login_conf
+        * - some NFSes have root read access disabled.
+        *
+        * XXX: This fails to configure additional groups.
+        */
        if (dir) {
            euid = geteuid();
            egid = getegid();