RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1073635 - IPA SELinux code looks for the host in the wrong sysdb subdir when a trusted user logs in
Summary: IPA SELinux code looks for the host in the wrong sysdb subdir when a trusted ...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: Jakub Hrozek
QA Contact: Kaushik Banerjee
URL:
Whiteboard:
Depends On:
Blocks: 1073810
TreeView+ depends on / blocked
 
Reported: 2014-03-06 20:34 UTC by Jakub Hrozek
Modified: 2020-05-02 17:39 UTC (History)
10 users (show)

Fixed In Version: sssd-1.11.2-58.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 11:58:30 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 3312 0 None None None 2020-05-02 17:39:20 UTC

Description Jakub Hrozek 2014-03-06 20:34:15 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/2270

When a trusted user logs in, the IPA sysdb code looks for the host object in the trusted sysdb subdir. Hosts are always stored in the IPA sysdb subdir. This may cause rules that reference the host itself to not match for a trusted user.
Comment 1 Jakub Hrozek 2014-03-11 18:44:42 UTC 
Fixed upstream:
    master: 36f606d6743e77721bedeed0907f1be7a19fa4f4
    sssd-1-11: 809e53108089bf892cd3c8da2ff4e475f2fd6b54
Comment 3 Scott Poore 2014-03-14 21:48:56 UTC 
Jakub,

How can I verify this bug?  

Is there a way to exercise a lookup where the rule referencing the host would fail before the fix is applied?

Or a way to see in the log the lookup go to trust instead of IPA location for the host?


Would I see something like:

IPA sysdb subdir: cn=accounts,dc=ipa1,dc=example,dc=test

Trust sysdb subdir:  cn=trusts,dc=ipa1,dc=example,dc=test

So, to see the problem, we'd see lookups to cn=trusts on login instead of cn=accounts?

Thanks,
Scott
Comment 4 Jakub Hrozek 2014-03-16 20:54:01 UTC 
(In reply to Scott Poore from comment #3)
> Jakub,
> 
> How can I verify this bug?  
> 
> Is there a way to exercise a lookup where the rule referencing the host
> would fail before the fix is applied?
> 
> Or a way to see in the log the lookup go to trust instead of IPA location
> for the host?
> 
> 
> Would I see something like:
> 
> IPA sysdb subdir: cn=accounts,dc=ipa1,dc=example,dc=test
> 
> Trust sysdb subdir:  cn=trusts,dc=ipa1,dc=example,dc=test
> 
> So, to see the problem, we'd see lookups to cn=trusts on login instead of
> cn=accounts?
> 
> Thanks,
> Scott

Honestly I was mostly using the ldbsearch tool to verify the fix, because depending on the order of preceding operations, the cache might already contain the right data.

I would recommend a test that uses a SELinux mapping rule on a server side that links to an IPA host and an AD user (with an external group). The cache should be removed completely before the test.

Without the fix, the rule wouldn't apply because the host would never match the search as the search would be based in IPA's subdirectory of the cache. With the patched packages, the SSSD should be able to evaluate the rules just fine.

Please let me know if the above doesn't work.
Comment 5 Scott Poore 2014-03-17 14:19:19 UTC 
Verified.

Version ::

sssd-1.11.2-60.el7.x86_64

Results ::


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: ipa_trust_func_bug_1073635: IPA SELinux code looks for the host in the wrong sysdb subdir when a trusted user logs in
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 09:18:30 ] ::  First make sure selinuxusermap is to unconfined...
Redirecting to /bin/systemctl stop  sssd.service
Redirecting to /bin/systemctl start  sssd.service
:: [   PASS   ] :: Running 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start' (Expected 0, got 0)
:: [   PASS   ] :: Running 'kdestroy -A' (Expected 0, got 0)
Password for aduser1.TEST: 
:: [   PASS   ] :: Running 'echo Secret123|kinit aduser1.TEST' (Expected 0, got 0)
:: [   PASS   ] :: Running 'ssh -K -l aduser1.test master.ipa1.example.test 'id -Z' > ipa_trust_func_bug_1073635.cA8am3 2>&1' (Expected 0, got 0)
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
:: [   PASS   ] :: Running 'cat ipa_trust_func_bug_1073635.cA8am3' (Expected 0, got 0)
:: [   PASS   ] :: File 'ipa_trust_func_bug_1073635.cA8am3' should contain 'unconfined_u.*:s0-s0:c0.c1023' 
:: [ 09:18:32 ] ::  Now Setup groups and selinuxusermap rule
:: [   PASS   ] :: Running 'kdestroy -A' (Expected 0, got 0)
Password for admin.TEST: 
:: [   PASS   ] :: Running 'echo Secret123|kinit admin' (Expected 0, got 0)
-----------------------
Added group "gr1073635"
-----------------------
  Group name: gr1073635
  Description: 0
  GID: 1961400011
:: [   PASS   ] :: Running 'ipa group-add --desc=0 gr1073635' (Expected 0, got 0)
---------------------------
Added group "gr1073635_ext"
---------------------------
  Group name: gr1073635_ext
  Description: 0
:: [   PASS   ] :: Running 'ipa group-add --desc=0 gr1073635_ext --external' (Expected 0, got 0)
  Group name: gr1073635
  Description: 0
  GID: 1961400011
  Member groups: gr1073635_ext
-------------------------
Number of members added 1
-------------------------
:: [   PASS   ] :: Running 'ipa group-add-member gr1073635 --groups=gr1073635_ext' (Expected 0, got 0)
  Group name: gr1073635_ext
  Description: 0
  External member: S-1-5-21-1515602834-2930230041-3336973146-1125
  Member of groups: gr1073635
-------------------------
Number of members added 1
-------------------------
:: [   PASS   ] :: Running 'ipa group-add-member gr1073635_ext --users='' --groups=''             --external='aduser1.test'' (Expected 0, got 0)
----------------------------------------
Added SELinux User Map "selinux_1073635"
----------------------------------------
  Rule name: selinux_1073635
  SELinux User: staff_u:s0-s0:c0.c1023
  Enabled: TRUE
:: [   PASS   ] :: Running 'ipa selinuxusermap-add --selinuxuser='staff_u:s0-s0:c0.c1023' selinux_1073635' (Expected 0, got 0)
  Rule name: selinux_1073635
  SELinux User: staff_u:s0-s0:c0.c1023
  Enabled: TRUE
  User Groups: gr1073635
-------------------------
Number of members added 1
-------------------------
:: [   PASS   ] :: Running 'ipa selinuxusermap-add-user selinux_1073635 --groups=gr1073635' (Expected 0, got 0)
  Rule name: selinux_1073635
  SELinux User: staff_u:s0-s0:c0.c1023
  Enabled: TRUE
  User Groups: gr1073635
  Hosts: master.ipa1.example.test
-------------------------
Number of members added 1
-------------------------
:: [   PASS   ] :: Running 'ipa selinuxusermap-add-host selinux_1073635 --hosts=master.ipa1.example.test' (Expected 0, got 0)
:: [ 09:18:38 ] ::  Now test selinuxusermap rule
Redirecting to /bin/systemctl stop  sssd.service
Redirecting to /bin/systemctl start  sssd.service
:: [   PASS   ] :: Running 'service sssd stop; rm -rf /var/lib/sss/{db,mc}/*; service sssd start' (Expected 0, got 0)
:: [   PASS   ] :: Running 'kdestroy -A' (Expected 0, got 0)
Password for aduser1.TEST: 
:: [   PASS   ] :: Running 'echo Secret123|kinit aduser1.TEST' (Expected 0, got 0)
:: [   PASS   ] :: Running 'ssh -K -l aduser1.test master.ipa1.example.test 'id -Z' > ipa_trust_func_bug_1073635.cA8am3 2>&1' (Expected 0, got 0)
staff_u:staff_r:staff_t:s0-s0:c0.c1023
:: [   PASS   ] :: Running 'cat ipa_trust_func_bug_1073635.cA8am3' (Expected 0, got 0)
:: [   PASS   ] :: File 'ipa_trust_func_bug_1073635.cA8am3' should contain 'staff_u.*:s0-s0:c0.c1023' 
:: [ 09:18:40 ] ::  Now cleanup groups and rules
:: [   PASS   ] :: Running 'kdestroy -A' (Expected 0, got 0)
Password for admin.TEST: 
:: [   PASS   ] :: Running 'echo Secret123|kinit admin' (Expected 0, got 0)
-------------------------
Deleted group "gr1073635"
-------------------------
:: [   PASS   ] :: Running 'ipa group-del gr1073635' (Expected 0, got 0)
-----------------------------
Deleted group "gr1073635_ext"
-----------------------------
:: [   PASS   ] :: Running 'ipa group-del gr1073635_ext' (Expected 0, got 0)
------------------------------------------
Deleted SELinux User Map "selinux_1073635"
------------------------------------------
:: [   PASS   ] :: Running 'ipa selinuxusermap-del selinux_1073635' (Expected 0, got 0)
Comment 6 Ludek Smid 2014-06-13 11:58:30 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.
Note You need to log in before you can comment on or make changes to this bug.