Bug 1198339 – ipa-client-install adds extra sss to sudoers in nsswitch.conf

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1198339 - ipa-client-install adds extra sss to sudoers in nsswitch.conf

Summary:	ipa-client-install adds extra sss to sudoers in nsswitch.conf

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	ipa (Show other bugs)
Sub Component:
Version:	6.6
Hardware:	Unspecified Unspecified

Priority	medium Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	IPA Maintainers
QA Contact:	Namita Soman
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2015-03-03 15:18 EST by Scott Poore
Modified:	2015-07-22 03:39 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:	ipa-3.0.0-43.el6
Doc Type:	Bug Fix
Doc Text:	Running ipa-client-install added the "sss" entry to the sudoers line in nsswitch.conf even if "sss" was already configured and the entry was present in the file. Duplicate "sss" then caused sudo to become unresponsive. With this update, ipa-client-install no longer adds "sss" if it is already present in nsswitch.conf and does not cause sudo to hang in this situation.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-07-22 03:39:46 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:1462	normal	SHIPPED_LIVE	Moderate: ipa security and bug fix update	2015-07-21 10:14:52 EDT

Groups: None (edit)

Description Scott Poore 2015-03-03 15:18:26 EST

Description of problem:

If /etc/nsswitch.conf already has sudoers entry with sss, ipa-client-install should not add another entry to the line.  However, it does:

sudoers: files sss sss

This can lead to sudo hanging like in bug #1147498.


Version-Release number of selected component (if applicable):
ipa-client-3.0.0-42.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1.  setup IPA server to test against
2.  echo "sudoers: files sss" >> /etc/nsswitch.conf
3.  ipa-client-install
4.  grep sudoer /etc/nsswitch.conf

Actual results:
2 sss entries  on line.

Expected results:
1 sss entry on line.

Additional info:

Comment 1 Martin Kosek 2015-03-04 02:47:17 EST

Thanks for report. I see downstream patch missing this part in configure_nsswitch_database:

        # Make sure no service is added if already mentioned in the list
        added_services = [s for s in services
                          if s not in configured_services]

We should fix this one in next release, given it is causing problems.

Comment 3 Xiyang Dong 2015-03-30 14:26:24 EDT

Verified on ipa-client-3.0.0-45.el6.x86_64:

[root@idm-qe-03 yum.repos.d]# echo "sudoers: files sss" >> /etc/nsswitch.conf
[root@idm-qe-03 yum.repos.d]# ipa-client-install
Discovery was successful!
Hostname: idm-qe-03.testrelm.test
Realm: TESTRELM.TEST
DNS Domain: testrelm.test
IPA Server: idm-qe-01.testrelm.test
BaseDN: dc=testrelm,dc=test
.
.
.
Client configuration complete.
[root@idm-qe-03 yum.repos.d]# grep sudoer /etc/nsswitch.conf
sudoers: files sss

Comment 5 errata-xmlrpc 2015-07-22 03:39:46 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-1462.html

Note You need to log in before you can comment on or make changes to this bug.