Bug 902716

Summary: Rule mismatch isn't noticed before smart refresh on ppc64 and s390x
Product: Red Hat Enterprise Linux 6 Reporter: Nikolai Kondrashov <nikolai.kondrashov>
Component: sssdAssignee: Jakub Hrozek <jhrozek>
Status: CLOSED ERRATA QA Contact: Kaushik Banerjee <kbanerje>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.4CC: dpal, grajaiya, jgalipea, okos, pbrezina, tlavigne
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: sssd-1.9.2-79.el6 Doc Type: Bug Fix
Doc Text:
No documentation needed.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2013-02-21 09:43:49 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 905536    
Attachments:
Description Flags
mismatch_refresh_test.ldif
none
sssd.conf
none
mismatch_refresh_test.ldif none

Description Nikolai Kondrashov 2013-01-22 10:28:39 UTC 
Description of problem:
SSSD doesn't notice rule becoming a mismatch immediately, but only after a smart refresh on ppc64 and s390x with directory server running on x86_64.

Version-Release number of selected component (if applicable):
sssd-client-1.9.2-74.el6.s390x
libsss_idmap-1.9.2-74.el6.s390x
libsss_sudo-1.9.2-74.el6.s390x
sssd-1.9.2-74.el6.s390x

How reproducible:
always

Steps to Reproduce:
1. Setup LDAP directory, using the attached mismatch_refresh_test.ldif file as reference.
2. Setup SSSD client using the attached sssd.conf as reference.
3. Execute the following, replacing the server hostname:
---:<---
service sssd restart >/dev/null
ldapmodify -h dell-pe840-01.rhts.eng.bos.redhat.com -x -D cn=Manager,dc=example,dc=com -w Secret123 <<<"
dn: cn=test,ou=Sudoers,dc=example,dc=com
replace: sudoUser
sudoUser: user2" >/dev/null
su -c 'sudo -u user2 true' user1 && echo ALLOWED || echo DENIED
sleep 11
su -c 'sudo -u user2 true' user1 && echo ALLOWED || echo DENIED
--->:---

Actual results:
ALLOWED
user1 is not allowed to run sudo on ibm-z10-02.  This incident will be reported.
DENIED

Expected results:
user1 is not allowed to run sudo on ibm-z10-02.  This incident will be reported.
DENIED
user1 is not allowed to run sudo on ibm-z10-02.  This incident will be reported.
DENIED

Additional info:
This works as documented on x86_64 and i386.

Use the following command for test teardown, replacing the server hostname:
---:<---
ldapmodify  -h dell-pe840-01.rhts.eng.bos.redhat.com -x -D cn=Manager,dc=example,dc=com -w Secret123 <<<"
dn: cn=test,ou=Sudoers,dc=example,dc=com
replace: sudoUser
sudoUser: user1" >/dev/null
--->:---
Comment 1 Nikolai Kondrashov 2013-01-22 10:29:37 UTC 
Created attachment 685018 [details]
mismatch_refresh_test.ldif
Comment 2 Nikolai Kondrashov 2013-01-22 10:30:02 UTC 
Created attachment 685019 [details]
sssd.conf
Comment 3 Nikolai Kondrashov 2013-01-22 10:32:20 UTC 
Created attachment 685034 [details]
mismatch_refresh_test.ldif
Comment 5 Nikolai Kondrashov 2013-01-22 10:51:39 UTC 
I'd say this bug could lead to a security issue, where an administrator would expect access right revocation to become effective immediately on ppc64 or s390x, similarly to what happens on i386 or x86_64, and not only after smart refresh interval, which could be set noticeably long.
Comment 6 Pavel Březina 2013-01-22 11:49:21 UTC 
Upstream ticket:
https://fedorahosted.org/sssd/ticket/1779
Comment 7 Pavel Březina 2013-01-22 11:53:55 UTC 
Hi,
can you please attach logs? Also, would you be so kind as to prepare me test environment on these architectures? Thanks.
Comment 8 Jakub Hrozek 2013-01-22 12:10:18 UTC 
(In reply to comment #7)
> Hi,
> can you please attach logs? Also, would you be so kind as to prepare me test
> environment on these architectures? Thanks.

Details on reproduction environment were passed on IRC.
Comment 10 Nikolai Kondrashov 2013-01-29 18:49:08 UTC 
Verified as fixed with the following packages:
sssd-client-1.9.2-82.el6.s390x
libsss_idmap-1.9.2-82.el6.s390x
sssd-1.9.2-82.el6.s390x
libsss_sudo-1.9.2-82.el6.s390x

Relevant sudo suite output:

:: [   PASS   ] :: refresh_mod_rule_user_to_mismatch
Comment 11 errata-xmlrpc 2013-02-21 09:43:49 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0508.html