Bug 1135531
| Summary: | sudo with ldap doesn't work with 'user id' in sudoUser option | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | David Spurek <dspurek> | ||||
| Component: | sudo | Assignee: | Daniel Kopeček <dkopecek> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Dalibor Pospíšil <dapospis> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 6.6 | CC: | dapospis, pkis, pvrabec | ||||
| Target Milestone: | rc | Keywords: | Patch, Reopened | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | sudo-1.8.6p3-21.el6 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 1135539 (view as bug list) | Environment: | |||||
| Last Closed: | 2016-05-10 21:42:58 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1135539, 1217621 | ||||||
| Attachments: |
|
||||||
|
Description
David Spurek
2014-08-29 14:30:03 UTC
From the logs: Aug 17 12:53:09 sudo[6575] <- sudo_ldap_lookup @ ./ldap.c:2480 := 64 In this case, the return value of 64 means: FLAG_NO_HOST 0x040 and therefore no matching rules were found. Looks like a misconfiguration. Closing as not a bug. Reopen if you get the same results after ensuring that sudo is processing some rules and they don't match the user id... I think that this is a real bug. If I change sudoUser: #10001 to sudoUser: userallowed then everything works correctly: [test]getent passwd useralloweduserallowed:x:10001:20001:userallowed:/home/userallowed:/bin/bash dn: cn=rule1,ou=Sudoers,dc=my-domain,dc=com objectClass: top objectClass: sudoRole cn: rule1 sudoHost: ALL sudoCommand: ALL sudoUser: userallowed [test]su - userallowed -c 'sudo true'su: warning: cannot change directory to /home/userallowed: No such file or directory [test]echo $? 0 -------------------------------------------- # Sudoers, my-domain.com dn: ou=Sudoers,dc=my-domain,dc=com objectClass: top objectClass: organizationalUnit ou: Sudoers # defaults, Sudoers, my-domain.com dn: cn=defaults,ou=Sudoers,dc=my-domain,dc=com objectClass: top objectClass: sudoRole sudoOption: !authenticate sudoOption: !requiretty cn: defaults # rule1, Sudoers, my-domain.com dn: cn=rule1,ou=Sudoers,dc=my-domain,dc=com objectClass: top objectClass: sudoRole cn: rule1 sudoHost: ALL sudoCommand: ALL sudoUser: #10001 [test]su - userallowed -c 'sudo true' su: warning: cannot change directory to /home/userallowed: No such file or directory userallowed is not allowed to run sudo on rhel6-6. This incident will be reported. [test]echo $? 1 ------------------------------------ and with processing of other rules [test]getent passwd userallowed2 userallowed2:usersecret:10003:20003:userallowed2:/home/userallowed2:/bin/bash # Sudoers, my-domain.com dn: ou=Sudoers,dc=my-domain,dc=com objectClass: top objectClass: organizationalUnit ou: Sudoers # defaults, Sudoers, my-domain.com dn: cn=defaults,ou=Sudoers,dc=my-domain,dc=com objectClass: top objectClass: sudoRole sudoOption: !authenticate sudoOption: !requiretty cn: defaults # rule1, Sudoers, my-domain.com dn: cn=rule1,ou=Sudoers,dc=my-domain,dc=com objectClass: top objectClass: sudoRole cn: rule1 sudoHost: ALL sudoCommand: ALL sudoUser: #10001 # rule2, Sudoers, my-domain.com dn: cn=rule2,ou=Sudoers,dc=my-domain,dc=com objectClass: top objectClass: sudoRole cn: rule2 sudoHost: ALL sudoCommand: ALL sudoUser: userallowed2 [test]su - userallowed -c 'sudo true'su: warning: cannot change directory to /home/userallowed: No such file or directory userallowed is not allowed to run sudo on rhel6-6. This incident will be reported. [test]echo $? 1 [test]su - userallowed2 -c 'sudo true' su: warning: cannot change directory to /home/userallowed2: No such file or directory [test]echo $? 0 Created attachment 1105522 [details]
proposed patch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-0853.html |