public groups combined with dynamic groups implicitly makes probed groups public

[[email protected]…]

There is unexpected behavior if you combine a public group with dynamic, probed groups - the probed groups are effectively now public. I believe dynamic group membership should be suppressed when a public group is specified.

1. create a public group
2. create a probe that returns group membership (e.g., 'group:gutsy')
3. connect from a new client, specifying the public group w/ 'bcfg2 -p <groupname>'; this client should also be detected by the dynamic groups probe

You'll see the entries for both the specified public group are used, as well as the dynamic group. This could be exploited by a malicious client by forcing the probe to return the configuration info for a certain group, e.g., - 'group:kdc'

[desai]

Fixed in [a9cd2fd0099bcd47852d1a5c262cd0c55a6e59a8] (SVN r5496)