Bug 796960

Summary:	init script for nslcd does not include ability to use a /etc/sysconfig/* file
Product:	Red Hat Enterprise Linux 6	Reporter:	Shawn Michael <smichael>
Component:	nss-pam-ldapd	Assignee:	Nalin Dahyabhai <nalin>
Status:	CLOSED INSUFFICIENT_DATA	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.2	CC:	arthur, dpal, jhrozek, ksrot, prc
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-08-20 14:59:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Shawn Michael 2012-02-23 22:52:18 UTC

Description of problem:


Version-Release number of selected component (if applicable): nss-pam-ldapd-0.7.5-14.el6.x86_64

How reproducible: always


Steps to Reproduce:
1. install nss-pam-ldapd
2. examine /etc/init.d/nslcd for a reference to including /etc/sysconfig/nslcd
3.
  
Actual results:

There is no references to include /etc/sysconfig/nslcd in the /etc/init.d/nslcd init script.  


Expected results:

ALL init scritps should check for /etc/sysconfig/SCRIPT_NAME for additional options.

Additional info:

libnss3 by default does not pay attention to wildcard SSL certificates.  In order to validate wildcard SSL certs with libnss3 you must be able to set the enviornment variable NSS_USE_SHEXP_IN_CERT_NAME.  The appropriate place to set that variable with respec to nslcd would be in /etc/sysconfig/nslcd.  However that file doesn't exist, and even if it did it wouldn't be included by the /etc/init.d/nslcd init script.

The following line should be just after the ". /etc/init.d/functions" line:

[ -r /etc/sysconfig/nslcd ] && . /etc/sysconfig/nslcd

Comment 4 Arthur de Jong 2012-07-18 19:48:55 UTC

Setting environment variables in the init script will not do much good because nslcd clears the environment on start-up. This is intentional because the OpenLDAP library reacts differently depending on which environment variables are set.

Comment 5 Jakub Hrozek 2012-07-19 10:20:33 UTC

Shawn, with what Arthur said in comment #2, have you had a chance to test if sourcing the environment variable fixes the problem for you?

Comment 8 Jakub Hrozek 2012-08-20 14:59:59 UTC

The required information has not been provided in over a month. Closing as insufficient data.