Update.

	* grp/initgroups.c: Move compat_call implementation...
	* grp/compat-initgroups.c: ...to here.  New file.
	* grp/Makefile (distribute): Add compat-initgroups.c.
	(CFLAGS-initgroups.c): Add -DUSE_NSCD=1.
	* mscd/initgrcache.c: New file.
	* nscd/nscd_initgroups.c: New file.
	* nscd/Makefile (routines): Add nscd_initgroups.
	(nscd-modules): Add initgrcache.
	* nscd/cache.c (prune_cache): Add support for INITGROUPS entries.
	* nscd/connections.c: Handle INITGROUPS requests.
	* nscd/nscd-client.h: Define INITGROUPS, initgr_response_header.
	Add initgrdata element to struct datahead.  Fix typo in comment.
	* nscd/nscd_proto.h: Declare __nscd_getgrouplist.  Fix parameter
	type in __nscd_getgrgrid_r.
	* nscd/selinux.c (perms): Add INITGROUPS entry.

	* nscd/nscd_getai.c: No need to include <sys/mman.h>.

	* sunrpc/get_myaddr.c (get_myaddress): Account for interfaces without
	assigned addresses.
	* sunrpc/pmap_clnt.c (__get_myaddress): Likewise.
	* sunrpc/pmap_rmt.c (getbroadcastnets): Likewise.
	* sunrpc/clnt_udp.c (is_network_up): Likewise.

9 files changed, 582 insertions, 9 deletions

diff --git a/nscd/Makefile b/nscd/Makefile
index d24bf9c2a6..bf79606f07 100644
--- a/nscd/Makefile
+++ b/nscd/Makefile
@@ -21,7 +21,7 @@
 #
 subdir	:= nscd
 
-routines := nscd_getpw_r nscd_getgr_r nscd_gethst_r nscd_getai
+routines := nscd_getpw_r nscd_getgr_r nscd_gethst_r nscd_getai nscd_initgroups
 aux	:= nscd_helper
 
 include ../Makeconfig
@@ -32,7 +32,7 @@ vpath %.c ../locale/programs
 nscd-modules := nscd connections pwdcache getpwnam_r getpwuid_r grpcache \
 		getgrnam_r getgrgid_r hstcache gethstbyad_r gethstbynm2_r \
 		dbg_log nscd_conf nscd_stat cache mem nscd_setup_thread \
-		xmalloc xstrdup aicache
+		xmalloc xstrdup aicache initgrcache
 
 ifeq ($(have-thread-library),yes)
 
diff --git a/nscd/cache.c b/nscd/cache.c
index 468b8d272a..efac4b3bcc 100644
--- a/nscd/cache.c
+++ b/nscd/cache.c
@@ -317,6 +317,10 @@ prune_cache (struct database_dyn *table, time_t now)
 			  readdhstai (table, runp, dh);
 			  break;
 
+			case INITGROUPS:
+			  readdinitgroups (table, runp, dh);
+			  break;
+
 			default:
 			  assert (! "should never happen");
 			}
diff --git a/nscd/connections.c b/nscd/connections.c
index 164fdfbc84..5de7c3b331 100644
--- a/nscd/connections.c
+++ b/nscd/connections.c
@@ -85,7 +85,8 @@ const char *serv2str[LASTREQ] =
   [GETFDPW] = "GETFDPW",
   [GETFDGR] = "GETFDGR",
   [GETFDHST] = "GETFDHST",
-  [GETAI] = "GETAI"
+  [GETAI] = "GETAI",
+  [INITGROUPS] = "INITGROUPS"
 };
 
 /* The control data structures for the services.  */
@@ -154,6 +155,7 @@ static struct database_dyn *const serv2db[LASTREQ] =
   [GETFDGR] = &dbs[grpdb],
   [GETFDHST] = &dbs[hstdb],
   [GETAI] = &dbs[hstdb],
+  [INITGROUPS] = &dbs[grpdb]
 };
 
 
@@ -604,9 +606,11 @@ cannot handle old request version %d; current version is %d"),
 
   struct database_dyn *db = serv2db[req->type];
 
+  // XXX Clean up so that each new command need not introduce a
+  // XXX new conditional.
   if ((__builtin_expect (req->type, GETPWBYNAME) >= GETPWBYNAME
        && __builtin_expect (req->type, LASTDBREQ) <= LASTDBREQ)
-      || req->type == GETAI)
+      || req->type == GETAI || req->type == INITGROUPS)
     {
       if (__builtin_expect (debug_level, 0) > 0)
 	{
@@ -719,6 +723,10 @@ cannot handle old request version %d; current version is %d"),
       addhstai (db, fd, req, key, uid);
       break;
 
+    case INITGROUPS:
+      addinitgroups (db, fd, req, key, uid);
+      break;
+
     case GETSTAT:
     case SHUTDOWN:
     case INVALIDATE:
diff --git a/nscd/initgrcache.c b/nscd/initgrcache.c
new file mode 100644
index 0000000000..124b4bae62
--- /dev/null
+++ b/nscd/initgrcache.c
@@ -0,0 +1,391 @@
+/* Cache handling for host lookup.
+   Copyright (C) 2004 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+   Contributed by Ulrich Drepper <drepper@redhat.com>, 2004.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, write to the Free
+   Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+   02111-1307 USA.  */
+
+#include <assert.h>
+#include <errno.h>
+#include <grp.h>
+#include <libintl.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+#include <sys/mman.h>
+#include <dbg_log.h>
+#include <nscd.h>
+
+#include "../nss/nsswitch.h"
+
+
+/* Type of the lookup function.  */
+typedef enum nss_status (*initgroups_dyn_function) (const char *, gid_t,
+						    long int *, long int *,
+						    gid_t **, long int, int *);
+
+
+static const initgr_response_header notfound =
+{
+  .version = NSCD_VERSION,
+  .found = 0,
+  .ngrps = 0
+};
+
+
+#include "../grp/compat-initgroups.c"
+
+
+static void
+addinitgroupsX (struct database_dyn *db, int fd, request_header *req,
+		void *key, uid_t uid, struct hashentry *he,
+		struct datahead *dh)
+{
+  /* Search for the entry matching the key.  Please note that we don't
+     look again in the table whether the dataset is now available.  We
+     simply insert it.  It does not matter if it is in there twice.  The
+     pruning function only will look at the timestamp.  */
+
+
+  /* We allocate all data in one memory block: the iov vector,
+     the response header and the dataset itself.  */
+  struct dataset
+  {
+    struct datahead head;
+    initgr_response_header resp;
+    char strdata[0];
+  } *dataset = NULL;
+
+  if (__builtin_expect (debug_level > 0, 0))
+    {
+      if (he == NULL)
+	dbg_log (_("Haven't found \"%s\" in group cache!"), (char *) key);
+      else
+	dbg_log (_("Reloading \"%s\" in group cache!"), (char *) key);
+    }
+
+  static service_user *group_database;
+  service_user *nip = NULL;
+  int no_more;
+
+  if (group_database != NULL)
+    {
+      nip = group_database;
+      no_more = 0;
+    }
+  else
+    no_more = __nss_database_lookup ("group", NULL,
+				     "compat [NOTFOUND=return] files", &nip);
+
+ /* We always use sysconf even if NGROUPS_MAX is defined.  That way, the
+     limit can be raised in the kernel configuration without having to
+     recompile libc.  */
+  long int limit = __sysconf (_SC_NGROUPS_MAX);
+
+  long int size;
+  if (limit > 0)
+    /* We limit the size of the intially allocated array.  */
+    size = MIN (limit, 64);
+  else
+    /* No fixed limit on groups.  Pick a starting buffer size.  */
+    size = 16;
+
+  long int start = 0;
+  bool all_tryagain = true;
+
+  /* This is temporary memory, we need not (ad must not) call
+     mempool_alloc.  */
+  // XXX This really should use alloca.  need to change the backends.
+  gid_t *groups = (gid_t *) malloc (size * sizeof (gid_t));
+  if (__builtin_expect (groups == NULL, 0))
+    /* No more memory.  */
+    goto out;
+
+  /* Nothing added yet.  */
+  while (! no_more)
+    {
+      enum nss_status status;
+      initgroups_dyn_function fct;
+      fct = __nss_lookup_function (nip, "initgroups_dyn");
+
+      if (fct == NULL)
+	{
+	  status = compat_call (nip, key, -1, &start, &size, &groups,
+				limit, &errno);
+
+	  if (nss_next_action (nip, NSS_STATUS_UNAVAIL) != NSS_ACTION_CONTINUE)
+	    break;
+	}
+      else
+	status = DL_CALL_FCT (fct, (key, -1, &start, &size, &groups,
+				    limit, &errno));
+
+      if (status != NSS_STATUS_TRYAGAIN)
+	all_tryagain = false;
+
+      /* This is really only for debugging.  */
+      if (NSS_STATUS_TRYAGAIN > status || status > NSS_STATUS_RETURN)
+	__libc_fatal ("illegal status in internal_getgrouplist");
+
+      if (status != NSS_STATUS_SUCCESS
+	  && nss_next_action (nip, status) == NSS_ACTION_RETURN)
+	 break;
+
+      if (nip->next == NULL)
+	no_more = -1;
+      else
+	nip = nip->next;
+    }
+
+  ssize_t total;
+  ssize_t written;
+ out:
+  if (start == 0)
+    {
+      /* Nothing found.  Create a negative result record.  */
+      written = total = sizeof (notfound);
+
+      if (he != NULL && all_tryagain)
+	{
+	  /* If we have an old record available but cannot find one now
+	     because the service is not available we keep the old record
+	     and make sure it does not get removed.  */
+	  if (reload_count != UINT_MAX && dh->nreloads == reload_count)
+	    /* Do not reset the value if we never not reload the record.  */
+	    dh->nreloads = reload_count - 1;
+	}
+      else
+	{
+	  /* We have no data.  This means we send the standard reply for this
+	     case.  */
+	  if (fd != -1)
+	    written = TEMP_FAILURE_RETRY (write (fd, &notfound, total));
+
+	  dataset = mempool_alloc (db, sizeof (struct dataset) + req->key_len);
+	  /* If we cannot permanently store the result, so be it.  */
+	  if (dataset != NULL)
+	    {
+	      dataset->head.allocsize = sizeof (struct dataset) + req->key_len;
+	      dataset->head.recsize = total;
+	      dataset->head.notfound = true;
+	      dataset->head.nreloads = 0;
+	      dataset->head.usable = true;
+
+	      /* Compute the timeout time.  */
+	      dataset->head.timeout = time (NULL) + db->negtimeout;
+
+	      /* This is the reply.  */
+	      memcpy (&dataset->resp, &notfound, total);
+
+	      /* Copy the key data.  */
+	      char *key_copy = memcpy (dataset->strdata, key, req->key_len);
+
+	      /* If necessary, we also propagate the data to disk.  */
+	      if (db->persistent)
+		{
+		  // XXX async OK?
+		  uintptr_t pval = (uintptr_t) dataset & ~pagesize_m1;
+		  msync ((void *) pval,
+			 ((uintptr_t) dataset & pagesize_m1)
+			 + sizeof (struct dataset) + req->key_len, MS_ASYNC);
+		}
+
+	      /* Now get the lock to safely insert the records.  */
+	      pthread_rwlock_rdlock (&db->lock);
+
+	      if (cache_add (req->type, key_copy, req->key_len,
+			     &dataset->head, true, db, uid) < 0)
+		/* Ensure the data can be recovered.  */
+		dataset->head.usable = false;
+
+	      pthread_rwlock_unlock (&db->lock);
+
+	      /* Mark the old entry as obsolete.  */
+	      if (dh != NULL)
+		dh->usable = false;
+	    }
+	  else
+	    ++db->head->addfailed;
+	}
+    }
+  else
+    {
+
+      written = total = sizeof (struct dataset) + start * sizeof (int32_t);
+
+      /* If we refill the cache, first assume the reconrd did not
+	 change.  Allocate memory on the cache since it is likely
+	 discarded anyway.  If it turns out to be necessary to have a
+	 new record we can still allocate real memory.  */
+      bool alloca_used = false;
+      dataset = NULL;
+
+      if (he == NULL)
+	{
+	  dataset = (struct dataset *) mempool_alloc (db,
+						      total + req->key_len);
+	  if (dataset == NULL)
+	    ++db->head->addfailed;
+	}
+
+      if (dataset == NULL)
+	{
+	  /* We cannot permanently add the result in the moment.  But
+	     we can provide the result as is.  Store the data in some
+	     temporary memory.  */
+	  dataset = (struct dataset *) alloca (total + req->key_len);
+
+	  /* We cannot add this record to the permanent database.  */
+	  alloca_used = true;
+	}
+
+      dataset->head.allocsize = total + req->key_len;
+      dataset->head.recsize = total - offsetof (struct dataset, resp);
+      dataset->head.notfound = false;
+      dataset->head.nreloads = he == NULL ? 0 : (dh->nreloads + 1);
+      dataset->head.usable = true;
+
+      /* Compute the timeout time.  */
+      dataset->head.timeout = time (NULL) + db->postimeout;
+
+      dataset->resp.version = NSCD_VERSION;
+      dataset->resp.found = 1;
+      dataset->resp.ngrps = start;
+
+      char *cp = dataset->strdata;
+
+      /* Copy the GID values.  If the size of the types match this is
+	 very simple.  */
+      if (sizeof (gid_t) == sizeof (int32_t))
+	cp = mempcpy (cp, groups, start * sizeof (gid_t));
+      else
+	{
+	  gid_t *gcp = (gid_t *) cp;
+
+	  for (int i = 0; i < start; ++i)
+	    *gcp++ = groups[i];
+
+	  cp = (char *) gcp;
+	}
+
+      /* Finally the user name.  */
+      memcpy (cp, key, req->key_len);
+
+      /* Now we can determine whether on refill we have to create a new
+	 record or not.  */
+      if (he != NULL)
+	{
+	  assert (fd == -1);
+
+	  if (total + req->key_len == dh->allocsize
+	      && total - offsetof (struct dataset, resp) == dh->recsize
+	      && memcmp (&dataset->resp, dh->data,
+			 dh->allocsize - offsetof (struct dataset, resp)) == 0)
+	    {
+	      /* The data has not changed.  We will just bump the
+		 timeout value.  Note that the new record has been
+		 allocated on the stack and need not be freed.  */
+	      dh->timeout = dataset->head.timeout;
+	      ++dh->nreloads;
+	    }
+	  else
+	    {
+	      /* We have to create a new record.  Just allocate
+		 appropriate memory and copy it.  */
+	      struct dataset *newp
+		= (struct dataset *) mempool_alloc (db, total + req->key_len);
+	      if (newp != NULL)
+		{
+		  /* Adjust pointer into the memory block.  */
+		  cp = (char *) newp + (cp - (char *) dataset);
+
+		  dataset = memcpy (newp, dataset, total + req->key_len);
+		  alloca_used = false;
+		}
+
+	      /* Mark the old record as obsolete.  */
+	      dh->usable = false;
+	    }
+	}
+      else
+	{
+	  /* We write the dataset before inserting it to the database
+	     since while inserting this thread might block and so would
+	     unnecessarily let the receiver wait.  */
+	  assert (fd != -1);
+
+	  written = TEMP_FAILURE_RETRY (write (fd, &dataset->resp, total));
+	}
+
+
+      /* Add the record to the database.  But only if it has not been
+	 stored on the stack.  */
+      if (! alloca_used)
+	{
+	  /* If necessary, we also propagate the data to disk.  */
+	  if (db->persistent)
+	    {
+	      // XXX async OK?
+	      uintptr_t pval = (uintptr_t) dataset & ~pagesize_m1;
+	      msync ((void *) pval,
+		     ((uintptr_t) dataset & pagesize_m1) + total +
+		     req->key_len, MS_ASYNC);
+	    }
+
+	  /* Now get the lock to safely insert the records.  */
+	  pthread_rwlock_rdlock (&db->lock);
+
+	  if (cache_add (INITGROUPS, cp, req->key_len, &dataset->head, true,
+			 db, uid) < 0)
+	    /* Could not allocate memory.  Make sure the data gets
+	       discarded.  */
+	    dataset->head.usable = false;
+
+	  pthread_rwlock_unlock (&db->lock);
+	}
+    }
+
+  free (groups);
+
+  if (__builtin_expect (written != total, 0) && debug_level > 0)
+    {
+      char buf[256];
+      dbg_log (_("short write in %s: %s"), __FUNCTION__,
+	       strerror_r (errno, buf, sizeof (buf)));
+    }
+}
+
+
+void
+addinitgroups (struct database_dyn *db, int fd, request_header *req, void *key,
+	       uid_t uid)
+{
+  addinitgroupsX (db, fd, req, key, uid, NULL, NULL);
+}
+
+
+void
+readdinitgroups (struct database_dyn *db, struct hashentry *he,
+		 struct datahead *dh)
+{
+  request_header req =
+    {
+      .type = INITGROUPS,
+      .key_len = he->len
+    };
+
+  addinitgroupsX (db, -1, &req, db->data + he->key, he->owner, he, dh);
+}
diff --git a/nscd/nscd-client.h b/nscd/nscd-client.h
index 4451349278..930255cb81 100644
--- a/nscd/nscd-client.h
+++ b/nscd/nscd-client.h
@@ -62,6 +62,7 @@ typedef enum
   GETFDGR,
   GETFDHST,
   GETAI,
+  INITGROUPS,
   LASTREQ
 } request_type;
 
@@ -140,6 +141,15 @@ struct nscd_ai_result
   char *addrs;
 };
 
+/* Structure sent in reply to initgroups query.  Note that this struct is
+   sent also if the service is disabled or there is no record found.  */
+typedef struct
+{
+  int32_t version;
+  int32_t found;
+  nscd_ssize_t ngrps;
+} initgr_response_header;
+
 
 /* Type for offsets in data part of database.  */
 typedef uint32_t ref_t;
@@ -173,6 +183,7 @@ struct datahead
     gr_response_header grdata;
     hst_response_header hstdata;
     ai_response_header aidata;
+    initgr_response_header initgrdata;
     nscd_ssize_t align1;
     nscd_time_t align2;
   } data[0];
@@ -244,7 +255,7 @@ struct mapped_database
   const struct database_pers_head *head;
   const char *data;
   size_t mapsize;
-  int counter;		/* > 0 indicates it isusable.  */
+  int counter;		/* > 0 indicates it is usable.  */
 };
 #define NO_MAPPING ((struct mapped_database *) -1l)
 
diff --git a/nscd/nscd_getai.c b/nscd/nscd_getai.c
index a9eac48ac8..6a4476fa7c 100644
--- a/nscd/nscd_getai.c
+++ b/nscd/nscd_getai.c
@@ -23,7 +23,6 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
-#include <sys/mman.h>
 #include <not-cancel.h>
 
 #include "nscd-client.h"
diff --git a/nscd/nscd_initgroups.c b/nscd/nscd_initgroups.c
new file mode 100644
index 0000000000..513d35d1e1
--- /dev/null
+++ b/nscd/nscd_initgroups.c
@@ -0,0 +1,158 @@
+/* Copyright (C) 2004 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+   Contributed by Ulrich Drepper <drepper@redhat.com>, 2004.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, write to the Free
+   Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+   02111-1307 USA.  */
+
+#include <assert.h>
+#include <errno.h>
+#include <grp.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <not-cancel.h>
+
+#include "nscd-client.h"
+#include "nscd_proto.h"
+
+
+libc_locked_map_ptr (map_handle);
+/* Note that we only free the structure if necessary.  The memory
+   mapping is not removed since it is not visible to the malloc
+   handling.  */
+libc_freeres_fn (gr_map_free)
+{
+
+  if (map_handle.mapped != NO_MAPPING)
+    free (map_handle.mapped);
+}
+
+
+int
+__nscd_getgrouplist (const char *user, gid_t group, long int *size,
+		     gid_t **groupsp, long int limit)
+{
+  size_t userlen = strlen (user) + 1;
+  const initgr_response_header *initgr_resp = NULL;
+  char *respdata = NULL;
+  int retval = -1;
+  int sock = -1;
+  int gc_cycle;
+
+  /* If the mapping is available, try to search there instead of
+     communicating with the nscd.  */
+  struct mapped_database *mapped = __nscd_get_map_ref (GETFDGR, "group",
+						       &map_handle, &gc_cycle);
+ retry:
+  if (mapped != NO_MAPPING)
+    {
+      const struct datahead *found = __nscd_cache_search (INITGROUPS, user,
+							  userlen, mapped);
+      if (found != NULL)
+	{
+	  initgr_resp = &found->data[0].initgrdata;
+	  respdata = (char *) (initgr_resp + 1);
+	  char *recend = (char *) found->data + found->recsize;
+
+	  if (respdata + initgr_resp->ngrps * sizeof (int32_t) > recend)
+	    goto out;
+	}
+    }
+
+  /* If we do not have the cache mapped, try to get the data over the
+     socket.  */
+  initgr_response_header initgr_resp_mem;
+  if (initgr_resp == NULL)
+    {
+      sock = __nscd_open_socket (user, userlen, INITGROUPS, &initgr_resp_mem,
+				 sizeof (initgr_resp_mem));
+      if (sock == -1)
+	/* nscd not running or wrong version or hosts caching disabled.  */
+	__nss_not_use_nscd_group = 1;
+
+      initgr_resp = &initgr_resp_mem;
+    }
+
+  if (initgr_resp->found == 1)
+    {
+      /* The following code assumes that gid_t and int32_t are the
+	 same size.  This is the case for al existing implementation.
+	 If this should change some code needs to be added which
+	 doesn't use memcpy but instead copies each array element one
+	 by one.  */
+      assert (sizeof (int32_t) == sizeof (gid_t));
+
+      /* Make sure we have enough room.  We always count GROUP in even
+	 though we might not end up adding it.  */
+      if (*size < initgr_resp->ngrps + 1)
+	{
+	  gid_t *newp = realloc (*groupsp,
+				 (initgr_resp->ngrps + 1) * sizeof (gid_t));
+	  if (newp == NULL)
+	    /* We cannot increase the buffer size.  */
+	    goto out;
+
+	  *groupsp = newp;
+	  *size = initgr_resp->ngrps + 1;
+	}
+
+      if (respdata == NULL)
+	{
+	  /* Read the data from the socket.  */
+	  if ((size_t) TEMP_FAILURE_RETRY (__read (sock, *groupsp,
+						   initgr_resp->ngrps
+						   * sizeof (gid_t)))
+	      == initgr_resp->ngrps * sizeof (gid_t))
+	    retval = initgr_resp->ngrps;
+	}
+      else
+	{
+	  /* Just copy the data.  */
+	  retval = initgr_resp->ngrps;
+	  memcpy (*groupsp, respdata, retval * sizeof (gid_t));
+	}
+
+      /* Check whether GROUP is part of the mix.  If not, add it.  */
+      if (retval >= 0)
+	{
+	  int cnt;
+	  for (cnt = 0; cnt < retval; ++cnt)
+	    if ((*groupsp)[cnt] == group)
+	      break;
+
+	  if (cnt == retval)
+	    (*groupsp)[retval++] = group;
+	}
+    }
+  else
+    {
+      /* The `errno' to some value != ERANGE.  */
+      __set_errno (ENOENT);
+      /* Even though we have not found anything, the result is zero.  */
+      retval = 0;
+    }
+
+  if (sock != -1)
+    close_not_cancel_no_status (sock);
+ out:
+  if (__nscd_drop_map_ref (mapped, gc_cycle) != 0)
+    /* When we come here this means there has been a GC cycle while we
+       were looking for the data.  This means the data might have been
+       inconsistent.  Retry.  */
+    goto retry;
+
+  return retval;
+}
diff --git a/nscd/nscd_proto.h b/nscd/nscd_proto.h
index eb685a5eb0..64d9bd0043 100644
--- a/nscd/nscd_proto.h
+++ b/nscd/nscd_proto.h
@@ -45,7 +45,7 @@ extern int __nscd_getpwuid_r (uid_t uid, struct passwd *resultbuf,
 extern int __nscd_getgrnam_r (const char *name, struct group *resultbuf,
 			      char *buffer, size_t buflen,
 			      struct group **result);
-extern int __nscd_getgrgid_r (uid_t uid, struct group *resultbuf,
+extern int __nscd_getgrgid_r (gid_t gid, struct group *resultbuf,
 			      char *buffer,  size_t buflen,
 			      struct group **result);
 extern int __nscd_gethostbyname_r (const char *name,
@@ -62,5 +62,6 @@ extern int __nscd_gethostbyaddr_r (const void *addr, socklen_t len, int type,
 				   struct hostent **result, int *h_errnop);
 extern int __nscd_getai (const char *key, struct nscd_ai_result **result,
 			 int *h_errnop);
-
+extern int __nscd_getgrouplist (const char *user, gid_t group, long int *size,
+				gid_t **groupsp, long int limit);
 #endif /* _NSCD_PROTO_H */
diff --git a/nscd/selinux.c b/nscd/selinux.c
index 0f975f71f6..77651e05c3 100644
--- a/nscd/selinux.c
+++ b/nscd/selinux.c
@@ -56,7 +56,8 @@ static const int perms[LASTREQ] =
   [GETFDPW] = NSCD__SHMEMPWD,
   [GETFDGR] = NSCD__SHMEMGRP,
   [GETFDHST] = NSCD__SHMEMHOST,
-  [GETAI] = NSCD__GETHOST
+  [GETAI] = NSCD__GETHOST,
+  [INITGROUPS] = NSCD__GETGRP
 };
 
 /* Store an entry ref to speed AVC decisions.  */