Bug 1006447 - sudo -ll does not list the rule names when sssd is used.
sudo -ll does not list the rule names when sssd is used.
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sudo (Show other bugs)
All Linux
medium Severity medium
: rc
: ---
Assigned To: Daniel Kopeček
David Spurek
Depends On:
Blocks: 1088464
  Show dependency treegraph
Reported: 2013-09-10 11:55 EDT by Najmuddin Chirammal
Modified: 2015-03-02 00:28 EST (History)
9 users (show)

See Also:
Fixed In Version: sudo-1.8.6p3-13.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1088464 (view as bug list)
Last Closed: 2014-10-14 02:45:52 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
proposed patch (875 bytes, patch)
2014-05-21 06:47 EDT, Daniel Kopeček
no flags Details | Diff

  None (edit)
Description Najmuddin Chirammal 2013-09-10 11:55:01 EDT
Description of problem: When SSSD is configured to get the sudo entries, the sudo long listing option does not list the rule names.
If there are 100s of rules present, it is difficult to then name of the rule allowed/denied sudo commands.

Version-Release number of selected component (if applicable): sudo-1.8.6p3-7.el6

How reproducible: Always.

Steps to Reproduce:
1. Setup Client to use 'sss' for sudoers
2. execute sudo -ll 

Actual results: sudo -ll does not list the rule name(s).

Expected results: long listing includes the rule name.

Additional info: Example:

# sudo -ll -U luser1
User luser1 may run the following commands on this host:

**LDAP Role: storage**
    RunAsUsers: ALL

**LDAP Role: passwd**
    RunAsUsers: ALL
[root@dhcp210-115 sssd]#


[root@dhcp210-115 sssd]# !vi
vi /etc/sudo-ldap.conf
[root@dhcp210-115 sssd]# vi /etc/nsswitch.conf
[root@dhcp210-115 sssd]# sudo -ll -U luser1
User luser1 may run the following commands on this host:
    RunAsUsers: ALL
    RunAsUsers: root
    RunAsUsers: ALL

As you can see, when we use ldap, it lists the rule, and the rule name is
missing with sssd.
Comment 3 Daniel Kopeček 2014-05-21 06:47:44 EDT
Created attachment 897899 [details]
proposed patch
Comment 9 errata-xmlrpc 2014-10-14 02:45:52 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

Comment 10 Ronaldo 2015-02-05 08:58:42 EST
After update to this version, sssd + ldap + sudo stop working.
Comment 11 David Spurek 2015-02-06 04:41:19 EST
Hi Ronaldo, thank you for the information. If you have a problem then contact our Global support services.

Note You need to log in before you can comment on or make changes to this bug.