Bug 1794607

Summary: SSSD must be able to resolve membership involving root with files provider
Product: Red Hat Enterprise Linux 8 Reporter: Muneaki Sugaya <msugaya>
Component: sssdAssignee: Pavel Březina <pbrezina>
Status: CLOSED ERRATA QA Contact: sssd-qe <sssd-qe>
Severity: urgent Docs Contact:
Priority: medium    
Version: 8.1CC: abmsharm, aborah, atikhono, bugproxy, dhorak, grajaiya, hannsj_uhl, jhrozek, jomiller, lslebodn, mzidek, pbrezina, sbose, sgoveas, stephan.schultchen, thalman, tscherf
Target Milestone: rcKeywords: Patch, Triaged
Target Release: 8.3Flags: pm-rhel: mirror+
Hardware: x86_64   
OS: Linux   
Whiteboard: sync-to-jira
Fixed In Version: sssd-2.3.0-4.el8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-04 02:04:37 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Muneaki Sugaya 2020-01-24 01:30:40 UTC
Description of problem:
With sssd, "getent group" miss a user whose primary group is root.

Version-Release number of selected component (if applicable):
RHEL8.1(sssd-common-2.2.0-19.el8.x86_64) or RHEL8.2 Beta(sssd-common-2.2.3-6.el8.x86_64)

How reproducible:
Often on RHEL8.1
Sometimes on RHEL8.2 Beta

Steps to Reproduce:
1. Install RHEL8.1 or RHEL8.2 Beta

2. Uncomment the following line in /etc/pam.d/su to implicitly trust users in the "wheel" group.

# vi /etc/pam.d/su
...
auth		sufficient	pam_wheel.so trust use_uid


3. Add a user as primary group: root and supplementary group: wheel

# useradd -g root -G wheel user01


4. Run su as follows.

# su user01			# *A
$ su
Password:                       # It's not supposed to.

*A "su user01" makes the following situation.
~~~
# grep wheel /etc/group
wheel:x:10:user01
# getent group wheel
wheel:x:10:
~~~

Actual results:

# getent group wheel
wheel:x:10:


Expected results:

# getent group wheel
wheel:x:10:user01


Additional info:

The following is a workaround.

# systemctl stop sssd
# rm -f /var/lib/sss/mc/*

Comment 1 Sumit Bose 2020-01-24 12:17:18 UTC
Hi,

thank you for the bug report, I can reproduce the issue. The reason is twofold. First SSSD does not handle users with uid or gid 0 and adds them to a negative cache. Second when returning groups SSSD checks its negative cache for each group member and does not return group-members which are in the negative cache. As a result pam_wheel does not see that the user with gid 0 is a member of the wheel group because in /etc/nsswitch.conf there is 'group:      sss files systemd' and since libnss_sss returns 'success' since the group is known by SSSD the other modules 'files' and 'systemd' are not tried.

So we need to special case the files provider lookups here, e.g. either not do the negative cache check for group members or not return the group at all if there is a hit in the negative cache so that 'files' can handle it? Or something completely different.

bye,
Sumit

Comment 2 Jakub Hrozek 2020-01-26 06:05:15 UTC
(In reply to Sumit Bose from comment #1)
> Hi,
> 
> thank you for the bug report, I can reproduce the issue. The reason is
> twofold. First SSSD does not handle users with uid or gid 0 and adds them to
> a negative cache. Second when returning groups SSSD checks its negative
> cache for each group member and does not return group-members which are in
> the negative cache. As a result pam_wheel does not see that the user with
> gid 0 is a member of the wheel group because in /etc/nsswitch.conf there is
> 'group:      sss files systemd' and since libnss_sss returns 'success' since
> the group is known by SSSD the other modules 'files' and 'systemd' are not
> tried.
> 
> So we need to special case the files provider lookups here, e.g. either not
> do the negative cache check for group members or not return the group at all
> if there is a hit in the negative cache so that 'files' can handle it? Or
> something completely different.
> 
> bye,
> Sumit

I think this might be even more complex, because even if you hit sysdb, there are codepaths that handle the UID/GID lookups and often the code goes like this:

uid = sysdb_get_id(sysdb, ldb_object, 0)
if (uid == 0) {
 fail();
}
note the zero is used as the default value and the condition then treats actually getting zero as a failure (or rather thinks that 'this is either a non-POSIX entry or it really has a zero ID in which case, let's not return it).

Comment 3 Pavel Březina 2020-03-12 10:52:19 UTC
*** Bug 1809489 has been marked as a duplicate of this bug. ***

Comment 4 Abhishek 2020-03-12 11:36:00 UTC
Pavel: By when can we expect a fix for this?

Comment 5 Pavel Březina 2020-03-12 11:54:25 UTC
I can't say this at the moment. This is not an easy fix and will require some time.

Customers affected by this can switch 'sss files' to 'files sss' in /etc/nsswitch.conf as a workaround.

Comment 6 Hanns-Joachim Uhl 2020-05-04 10:13:31 UTC
(In reply to Pavel Březina from comment #5)
> I can't say this at the moment. This is not an easy fix and will require
> some time.
> 
.
Hello Red Hat / Pavel,
... is there already an outlook when the fix will be available ...? Is the fix targeted for RHEL8.3 ...?
Please advise ...
Thanks in advance for your support.

Comment 7 Pavel Březina 2020-05-07 12:14:27 UTC
Are you willing to try this scratch build?
https://pbrezina.fedorapeople.org/scratch/1794607/

It is for 8.1, let me know if you need different build.

Please note that it is mostly proof of concept and it should not be used in production.

Comment 8 Pavel Březina 2020-05-20 11:44:19 UTC
Upstream ticket:
https://github.com/SSSD/sssd/issues/5170

Comment 9 Pavel Březina 2020-05-20 12:17:19 UTC
Upstream PR:
https://github.com/SSSD/sssd/pull/5171

Comment 10 Pavel Březina 2020-06-29 10:11:29 UTC
Pushed PR: https://github.com/SSSD/sssd/pull/5171

* `master`
    * 8969c43dc2d8d0800c2f0b509d078378db855622 - files: allow root membership

Comment 13 Anuj Borah 2020-07-11 15:49:31 UTC
With Older version:

[user01@ci-vm-10-0-137-189 upstream]$ rpm -qa | grep sssd
sssd-common-2.2.0-19.el8.x86_64
sssd-client-2.2.0-19.el8.x86_64
sssd-nfs-idmap-2.2.0-19.el8.x86_64
sssd-kcm-2.2.0-19.el8.x86_64
[user01@ci-vm-10-0-137-189 upstream]$ cat /etc/redhat-release
Red Hat Enterprise Linux release 8.1 (Ootpa)
[user01@ci-vm-10-0-137-189 upstream]$ grep wheel /etc/group
wheel:x:10:user01
[user01@ci-vm-10-0-137-189 upstream]$ getent group wheel
wheel:x:10:
[user01@ci-vm-10-0-137-189 upstream]$



With Fixed version:

[root@ci-vm-10-0-138-221 yum.repos.d]# su user01
[user01@ci-vm-10-0-138-221 yum.repos.d]$ grep wheel /etc/group
wheel:x:10:user01
[user01@ci-vm-10-0-138-221 yum.repos.d]$ getent group wheel
wheel:x:10:user01
[user01@ci-vm-10-0-138-221 yum.repos.d]$ rpm -qa | grep sssd
sssd-nfs-idmap-2.3.0-4.el8.x86_64
sssd-client-2.3.0-4.el8.x86_64
sssd-common-2.3.0-4.el8.x86_64
sssd-kcm-2.3.0-4.el8.x86_64
[user01@ci-vm-10-0-138-221 yum.repos.d]$ cat /etc/redhat-release
Red Hat Enterprise Linux release 8.3 Beta (Ootpa)

Comment 16 errata-xmlrpc 2020-11-04 02:04:37 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sssd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4569