Bug 1773567

* `master`
  * 4cfb20423ca9a3e9b2b3de627b751e61fb0cf560 - profiles: switch uid checks to pam_usertype

Steps to test:
- if it is an system account, i.e. uid in range <SYS_UID_MIN, SYS_UID_MAX> is is always authenticated through pam_unix (and not by sssd)
- the PAM configuration now reads these values from /etc/login.defs so any changes there should be immediately reflected

Verified with
[root@ci-vm-10-0-105-117 ~]# rpm -qa authselect sssd
authselect-1.2.1-2.el8.x86_64
sssd-2.3.0-7.el8.x86_64

Verification steps:

1) Update the /etc/login.defs and change SYS_UID_MAX and SYS_GID_MAX value to 1999

[root@ci-vm-10-0-105-117 ~]# cat /etc/login.defs | grep 'SYS_'
SYS_UID_MIN               201
SYS_UID_MAX              1999
SYS_GID_MIN               201
SYS_GID_MAX              1999

2) Add the system user with uid 1200

[root@ci-vm-10-0-105-117 ~]# useradd --system test_bar -u 1200

[root@ci-vm-10-0-105-117 ~]# id test_bar
uid=1200(test_bar) gid=1200(test_bar) groups=1200(test_bar)

3) Add the ldap user with same uid

dn: uid=foo100,ou=People,dc=example,dc=test
objectClass: top
objectClass: posixAccount
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
cn: foo100
uid: foo100
sn: foo100
loginShell: /bin/bash
homeDirectory: /home/foo100
uidNumber: 1200
gidNumber: 1200
mail: foo100
gecos: foo100 User
l: US
userPassword: Secret123

[root@ci-vm-10-0-105-117 ~]# getent passwd foo100@example1
foo100@example1:*:1200:1200:foo100 User::/bin/bash

4) Try to login the user with uid in the system range

[root@ci-vm-10-0-105-117 ~]# ssh -l foo100@example1 localhost
foo100@example1@localhost's password: 
Permission denied, please try again.
foo100@example1@localhost's password: 
Permission denied, please try again.
foo100@example1@localhost's password: 
foo100@example1@localhost: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

5) Restore the /etc/login.defs

[root@ci-vm-10-0-105-117 ~]# cat /etc/login.defs | grep 'SYS_'
SYS_UID_MIN               201
SYS_UID_MAX               999
SYS_GID_MIN               201
SYS_GID_MAX               999

6) Remove the cache and restart sssd

[root@ci-vm-10-0-105-117 ~]# systemctl stop sssd; rm -rf /var/lib/sss/db/*; systemctl start sssd

7) Check the authentication again 

[root@ci-vm-10-0-105-117 ~]# ssh -l foo100@example1 localhost
foo100@example1@localhost's password: 
Activate the web console with: systemctl enable --now cockpit.socket

This system is not registered to Red Hat Insights. See https://cloud.redhat.com/
To register this system, run: insights-client --register

Last failed login: Tue Aug 11 07:51:49 EDT 2020 from ::1 on ssh:notty
There were 3 failed login attempts since the last successful login.
Last login: Tue Aug 11 07:42:54 2020 from ::1
Could not chdir to home directory : No such file or directory
[foo100@example1@ci-vm-10-0-105-117 /]$ id 
uid=1200(foo100@example1) gid=1200(test_bar) groups=1200(test_bar) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[foo100@example1@ci-vm-10-0-105-117 /]$ logout
Connection to localhost closed.
[root@ci-vm-10-0-105-117 ~]# 

Thus from above steps marking the bug verified.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (authselect bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:4503