Bug 1198339 - ipa-client-install adds extra sss to sudoers in nsswitch.conf
Summary: ipa-client-install adds extra sss to sudoers in nsswitch.conf
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa
Version: 6.6
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Namita Soman
Depends On:
TreeView+ depends on / blocked
Reported: 2015-03-03 20:18 UTC by Scott Poore
Modified: 2015-07-22 07:39 UTC (History)
4 users (show)

Fixed In Version: ipa-3.0.0-43.el6
Doc Type: Bug Fix
Doc Text:
Running ipa-client-install added the "sss" entry to the sudoers line in nsswitch.conf even if "sss" was already configured and the entry was present in the file. Duplicate "sss" then caused sudo to become unresponsive. With this update, ipa-client-install no longer adds "sss" if it is already present in nsswitch.conf and does not cause sudo to hang in this situation.
Clone Of:
Last Closed: 2015-07-22 07:39:46 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1462 0 normal SHIPPED_LIVE Moderate: ipa security and bug fix update 2015-07-21 14:14:52 UTC

Description Scott Poore 2015-03-03 20:18:26 UTC
Description of problem:

If /etc/nsswitch.conf already has sudoers entry with sss, ipa-client-install should not add another entry to the line.  However, it does:

sudoers: files sss sss

This can lead to sudo hanging like in bug #1147498.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.  setup IPA server to test against
2.  echo "sudoers: files sss" >> /etc/nsswitch.conf
3.  ipa-client-install
4.  grep sudoer /etc/nsswitch.conf

Actual results:
2 sss entries  on line.

Expected results:
1 sss entry on line.

Additional info:

Comment 1 Martin Kosek 2015-03-04 07:47:17 UTC
Thanks for report. I see downstream patch missing this part in configure_nsswitch_database:

        # Make sure no service is added if already mentioned in the list
        added_services = [s for s in services
                          if s not in configured_services]

We should fix this one in next release, given it is causing problems.

Comment 3 Xiyang Dong 2015-03-30 18:26:24 UTC
Verified on ipa-client-3.0.0-45.el6.x86_64:

[root@idm-qe-03 yum.repos.d]# echo "sudoers: files sss" >> /etc/nsswitch.conf
[root@idm-qe-03 yum.repos.d]# ipa-client-install
Discovery was successful!
Hostname: idm-qe-03.testrelm.test
DNS Domain: testrelm.test
IPA Server: idm-qe-01.testrelm.test
BaseDN: dc=testrelm,dc=test
Client configuration complete.
[root@idm-qe-03 yum.repos.d]# grep sudoer /etc/nsswitch.conf
sudoers: files sss

Comment 5 errata-xmlrpc 2015-07-22 07:39:46 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.