RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1088564 - sudoNotBefore time is not always respected
Summary: sudoNotBefore time is not always respected
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: SSSD Maintainers
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-04-16 18:26 UTC by Kaushik Banerjee
Modified: 2020-05-02 17:41 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-08-01 07:37:05 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github SSSD sssd issues 3358 0 None None None 2020-05-02 17:41:53 UTC

Description Kaushik Banerjee 2014-04-16 18:26:47 UTC 
Description of problem:
sudoNotBefore time is not always respected

Version-Release number of selected component (if applicable):
1.11.2-65

How reproducible:
Very often

Steps to Reproduce:
1. On the ldapserver:
ldapsearch -xv -h ldapserver -b "dc=example,dc=com" cn=test
dn: cn=test,ou=Sudoers,dc=example,dc=com
objectClass: top
objectClass: sudoRole
sudoHost: ALL
sudoCommand: ALL
sudoUser: ALL
cn: test
sudoRunAsUser: ALL
sudoNotBefore: 20140409090729-0400

2. On the client:
# date +'%Y%m%d%H%M%S%z'                                            
20140409092740-0400       <== Which is way past the sudoNotBefore time

3. Try to sudo to a user.
# su user1 -c "sudo -u user2 ${*-true}"
user1 is not allowed to run sudo on client.  This incident will be reported.

Actual results:
sudo access is denied

Expected results:
sudo should work

Additional info:
Comment 2 Jakub Hrozek 2014-04-17 09:34:55 UTC 
Upstream ticket:
https://fedorahosted.org/sssd/ticket/2316
Comment 3 Jakub Hrozek 2014-04-24 08:09:10 UTC 
There are no known users of this feature. Targeting 7.1
Comment 4 Jakub Hrozek 2016-11-23 14:24:35 UTC 
Thank you for filing this bug report.

Since fixing this bug requires work in the upstream SSSD project which is not scheduled for the immediate future, I added a conditional development nack, pending upstream availability.
Comment 5 shridhar 2017-05-25 09:28:51 UTC 
The attribute Test cases are failing due to this bug. As this is low priority bug and no customer has implemented this. Could you confirm whether there are plans to fix it? If there is no plan to fix it then could this bug be closed with proper justification, so that we could remove the related test-cases.
Comment 6 Jakub Hrozek 2017-05-25 18:30:34 UTC 
(In reply to shridhar from comment #5)
> The attribute Test cases are failing due to this bug. As this is low
> priority bug and no customer has implemented this. Could you confirm whether
> there are plans to fix it? If there is no plan to fix it then could this bug
> be closed with proper justification, so that we could remove the related
> test-cases.

I don't think we plan on fixing this and I agree that with that in mind, it would be fair to close this bug as WONTFIX or UPSTREAM.
Comment 7 shridhar 2017-08-01 06:43:08 UTC 
(In reply to Jakub Hrozek from comment #6)
> (In reply to shridhar from comment #5)
> I don't think we plan on fixing this and I agree that with that in mind, it
> would be fair to close this bug as WONTFIX or UPSTREAM.
As you mentioned above, kindly close this bug as WONTFIX so that I could proceed with archiving of related testcases.
Comment 8 Fabiano Fidêncio 2017-08-01 07:37:05 UTC 
As per comment 6, I'm closing this bug as WONTFIX.
Note You need to log in before you can comment on or make changes to this bug.