Bug 1562025
| Summary: | externalUser sudo attribute must be fully-qualified | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Fabiano Fidêncio <fidencio> |
| Component: | sssd | Assignee: | Jakub Hrozek <jhrozek> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.6 | CC: | grajaiya, jhrozek, lslebodn, mkosek, msiddiqu, mzidek, ndehadra, pbrezina, sgoveas, tscherf |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | sssd-1.16.2-1.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-10-30 10:42:26 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Upstream ticket: https://pagure.io/SSSD/sssd/issue/3694 * master: 0f6b5b02afb35caae774ff4d52854a844d49f52e The steps below verifies the bug and its fix:
Reproducing on past version of sssd:
SSSD version:
sssd-1.15.2-50.el7_4.13.x86_64
IPA version:
ipa-server-4.5.0-22.el7_4.x86_64
ipa-client-4.5.0-22.el7_4.x86_64
[root@kvm-02-guest11 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.4 (Maipo)
testuser is ipa user, lcluser is external user.
[root@kvm-02-guest11 ~]# ipa sudorule-show readfiles
Rule name: readfiles
Enabled: TRUE
Host category: all
Command category: all
RunAs User category: all
RunAs Group category: all
Users: testuser
External User: lcluser
Sudo Deny Commands: /usr/bin/ls
Sudo Option: !authenticate
[root@kvm-02-guest11 ~]# su -c 'sudo -l' testuser
Matching Defaults entries for testuser on kvm-02-guest11:
!visiblepw, always_set_home, match_group_by_gid, env_reset, env_keep="COLORS
DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR
USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION
LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER
LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User testuser may run the following commands on kvm-02-guest11:
(ALL : ALL) NOPASSWD: ALL, !/usr/bin/ls
[root@kvm-02-guest11 ~]# su -c 'sudo -l' lcluser
sudo: no tty present and no askpass program specified
Reproducing on a version later the version than fixed version of sssd:
SSSD version:
sssd-1.16.2-12.el7.x86_64
IPA version:
ipa-server-4.5.4-10.el7_5.3.x86_64
ipa-client-4.5.4-10.el7_5.3.x86_64
ipa user is testuser, external user is lcluser
[root@kvm-02-guest24 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.5 (Maipo)
[root@kvm-02-guest24 ~]# ipa sudorule-show readfiles
Rule name: readfiles
Enabled: TRUE
Host category: all
Command category: all
RunAs User category: all
RunAs Group category: all
Users: testuser
External User: lcluser
Sudo Deny Commands: /usr/bin/ls
Sudo Option: !authenticate
[root@kvm-02-guest24 ~]# su -c 'sudo -l' testuser
Matching Defaults entries for testuser on kvm-02-guest24:
!visiblepw, always_set_home, match_group_by_gid, env_reset, env_keep="COLORS
DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR
USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION
LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER
LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User testuser may run the following commands on kvm-02-guest24:
(ALL : ALL) NOPASSWD: ALL, !/usr/bin/ls
[root@kvm-02-guest24 ~]# su -c 'sudo -l' lcluser
Matching Defaults entries for lcluser on kvm-02-guest24:
!visiblepw, always_set_home, match_group_by_gid, env_reset, env_keep="COLORS
DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR
USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION
LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER
LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
XAUTHORITY", secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User lcluser may run the following commands on kvm-02-guest24:
(ALL : ALL) NOPASSWD: ALL, !/usr/bin/ls
Based on comment#9 , marking the status to 'VERIFIED'. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:3158 |
The externalUser support has been broken with the introduction of the fully qualified attributes, because the provider was saving the data verbatim, but the sudo responder expects a fully qualified name. Reproducer: on the server: ipa sudocmd-add --desc='For reading log files' /usr/bin/less ipa sudorule-add readfiles ipa sudorule-add-user --users=lcluser ipa sudorule-mod --hostcat=all readfiles then on the client: configure sssd with: id_provider = files sudo_provider = ipa ipa_domain = ipa.test run: sudo useradd lcluser sudo passwd lcluser su - lcluser sudo -l