Bug 1006447 - sudo -ll does not list the rule names when sssd is used.
Summary: sudo -ll does not list the rule names when sssd is used.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sudo
Version: 6.4
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Daniel Kopeček
QA Contact: David Spurek
URL:
Whiteboard:
Depends On:
Blocks: 1088464
TreeView+ depends on / blocked
 
Reported: 2013-09-10 15:55 UTC by Najmuddin Chirammal
Modified: 2018-12-09 17:13 UTC (History)
9 users (show)

Fixed In Version: sudo-1.8.6p3-13.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1088464 (view as bug list)
Environment:
Last Closed: 2014-10-14 06:45:52 UTC
Target Upstream Version:


Attachments (Terms of Use)
proposed patch (875 bytes, patch)
2014-05-21 10:47 UTC, Daniel Kopeček
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2014:1484 0 normal SHIPPED_LIVE sudo bug fix update 2014-10-14 01:28:34 UTC

Description Najmuddin Chirammal 2013-09-10 15:55:01 UTC
Description of problem: When SSSD is configured to get the sudo entries, the sudo long listing option does not list the rule names.
If there are 100s of rules present, it is difficult to then name of the rule allowed/denied sudo commands.

Version-Release number of selected component (if applicable): sudo-1.8.6p3-7.el6


How reproducible: Always.


Steps to Reproduce:
1. Setup Client to use 'sss' for sudoers
2. execute sudo -ll 

Actual results: sudo -ll does not list the rule name(s).

Expected results: long listing includes the rule name.

Additional info: Example:
------------------------------
sudo_LDAP

# sudo -ll -U luser1
User luser1 may run the following commands on this host:

**LDAP Role: storage**
    RunAsUsers: ALL
    Commands:
    /bin/fdisk

**LDAP Role: passwd**
    RunAsUsers: ALL
    Commands:
    /usr/bin/passwd
[root@dhcp210-115 sssd]#

sudo_SSS

[root@dhcp210-115 sssd]# !vi
vi /etc/sudo-ldap.conf
[root@dhcp210-115 sssd]# vi /etc/nsswitch.conf
[root@dhcp210-115 sssd]# sudo -ll -U luser1
User luser1 may run the following commands on this host:
    RunAsUsers: ALL
    Commands:
    /bin/fdisk
    RunAsUsers: root
    Commands:
    /usr/bin/passwd
    RunAsUsers: ALL
    Commands:
    /bin/be_admkn
------------------------------

As you can see, when we use ldap, it lists the rule, and the rule name is
missing with sssd.

Comment 3 Daniel Kopeček 2014-05-21 10:47:44 UTC
Created attachment 897899 [details]
proposed patch

Comment 9 errata-xmlrpc 2014-10-14 06:45:52 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1484.html

Comment 10 Ronaldo 2015-02-05 13:58:42 UTC
After update to this version, sssd + ldap + sudo stop working.

Comment 11 David Spurek 2015-02-06 09:41:19 UTC
Hi Ronaldo, thank you for the information. If you have a problem then contact our Global support services.


Note You need to log in before you can comment on or make changes to this bug.