Description of problem:
The LDAP backend is not properly parsing sudoOptions. In at least one instance, this results in selinux roles not being applied.
Version-Release number of selected component (if applicable):
sudo-1.8.25p1-4.el8_0
How reproducible:
Difficult, without a full LDAP server backend configuration
Steps to Reproduce:
1. Configure an LDAP server which includes a sudoOptions configuration to allow escalation to a particular selinux role
sudoOption:role=sysadm_r
2. Access a system that is using the LDAP server for authentication services, where the user is in an SELinux user confined state as staff_r
3. Attempt to transition using 'sudo -i' to acquire the sysadm_r role
# sudo -i
# id -Z
Actual results:
# sudo -i
# id -Z
staff_u:staff_r:staff_t:s0
Expected results:
# sudo -i
# id -Z
sysadm_u:sysadm_r:sysadm_t:s0
Additional info:
The following commit from the upstream project has been identified as resolving the condition.
Fixed a bug in the sudoers LDAP back-end parsing the
command_timeout, role, type, privs and limitprivs sudoOptions. This also
affected cvtsudoers conversion from LDIF to sudoers or JSON.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2019:3598
Description of problem: The LDAP backend is not properly parsing sudoOptions. In at least one instance, this results in selinux roles not being applied. Version-Release number of selected component (if applicable): sudo-1.8.25p1-4.el8_0 How reproducible: Difficult, without a full LDAP server backend configuration Steps to Reproduce: 1. Configure an LDAP server which includes a sudoOptions configuration to allow escalation to a particular selinux role sudoOption:role=sysadm_r 2. Access a system that is using the LDAP server for authentication services, where the user is in an SELinux user confined state as staff_r 3. Attempt to transition using 'sudo -i' to acquire the sysadm_r role # sudo -i # id -Z Actual results: # sudo -i # id -Z staff_u:staff_r:staff_t:s0 Expected results: # sudo -i # id -Z sysadm_u:sysadm_r:sysadm_t:s0 Additional info: The following commit from the upstream project has been identified as resolving the condition. Fixed a bug in the sudoers LDAP back-end parsing the command_timeout, role, type, privs and limitprivs sudoOptions. This also affected cvtsudoers conversion from LDIF to sudoers or JSON.