Bug 1366569
| Summary: | glibc: default nsswitch.conf should not set initgroups | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Sudhir Menon <sumenon> | ||||
| Component: | glibc | Assignee: | Florian Weimer <fweimer> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Sergey Kolosov <skolosov> | ||||
| Severity: | high | Docs Contact: | Aneta Šteflová Petrová <apetrova> | ||||
| Priority: | high | ||||||
| Version: | 7.3 | CC: | abokovoy, ashankar, codonell, cww, fweimer, jhrozek, lslebodn, mcermak, mnewsome, mpetlan, pfrankli, pkis, sgoveas, skolosov, sumenon, tmraz, troels | ||||
| Target Milestone: | rc | Keywords: | ZStream | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | glibc-2.17-158.el7 | Doc Type: | Known Issue | ||||
| Doc Text: |
Machines joined to a realm are not able to resolve centrally managed supplementary groups
Installing an Identity Management (IdM) server or client does not add the `sss` option to the `initgroups` lookup entry in the `/etc/nsswitch.conf` file. As a consequence, looking up secondary groups for users managed by SSSD does not work as expected. As a work around, remove or comment out the line starting with `initgroups` in the `/etc/nsswitch.conf` file before the installation. This ensures that machines joined to the realm resolve centrally managed supplementary groups as expected.
|
Story Points: | --- | ||||
| Clone Of: | |||||||
| : | 1371879 1388638 (view as bug list) | Environment: | |||||
| Last Closed: | 2017-08-01 18:06:55 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 751450 | ||||||
| Bug Blocks: | 1304992, 1368973, 1388638, 1390370 | ||||||
| Attachments: |
|
||||||
|
Description
Sudhir Menon
2016-08-12 10:55:23 UTC
This is a complex issue and probably a minor regression caused by fix for bug 1329508. Authconfig when writing nsswitch.conf actually comments out the initgroups entry because just placing the sssd into it modifies the behaviour (or at least that was originally the case) that was expected by users and applications (see bug 751450). So I believe proper fix for this bug is to comment out the initgroups entry in default nsswitch.conf configuration. There is no fix for this problem in authconfig apart from reverting the fix for bug 1329508 - however I do not think this is a proper solution. Setting priority and severity to high/high. In my opinion, this bug should be fixed in 7.3, because otherwise a domain member is not able to resolve supplementary groups, which is really a basic functionality. Whether the fix comes in libc by removing the default initgroups line or in authconfig by changing the way nsswith.conf is generated is a detail from my point of view. But the case of installing a system and joining it to a domain with ipa-client-install is something we must fix. BTW what will be a difference from glibc point of view between "removing default initgroups line" and adding sss to initgroups by default. "sss" is already a default for passwd and groups. But I know that initgrous is a little bit special case. Created attachment 1196301 [details]
Workaround patch for authconfig
*** Bug 1368973 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2017:1916 |