Hide Forgot
Description of problem: Inconsistency in error message "user1 is not allowed" is changed to "user1 is not in the sudoers file", but not consistent across different tests. In rhel67 the error message "user1 is not allowed" was consistent across all tests. Is this change by design? Version-Release number of selected component (if applicable): coreutils-8.4-42.el6.x86_64 How reproducible: always Steps to Reproduce: 1. Setup sssd with sudo with 389ds/openldap server * With expected error message "user1 is not allowed" :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: refresh :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: user1 is not in the sudoers file. This incident will be reported. failed :: [ BEGIN ] :: refresh_add_rule_before_smart :: actually running 'strict eval 'client_sudo_user_is_denied'' user1 is not in the sudoers file. This incident will be reported. :: [ FAIL ] :: refresh_add_rule_before_smart (Expected 0, got 1) :: [ BEGIN ] :: refresh_add_rule_after_smart :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_add_rule_after_smart (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_user_to_mismatch :: actually running 'strict eval 'client_sudo_user_is_denied'' user1 is not in the sudoers file. This incident will be reported. :: [ FAIL ] :: refresh_mod_rule_user_to_mismatch (Expected 0, got 1) :: [ BEGIN ] :: refresh_mod_rule_user_to_match_before_smart :: actually running 'strict eval 'client_sudo_user_is_denied'' user1 is not in the sudoers file. This incident will be reported. :: [ FAIL ] :: refresh_mod_rule_user_to_match_before_smart (Expected 0, got 1) :: [ BEGIN ] :: refresh_mod_rule_user_to_match_after_smart :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_mod_rule_user_to_match_after_smart (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_host_to_mismatch :: actually running 'strict eval 'client_sudo_user_is_denied'' user1 is not in the sudoers file. This incident will be reported. :: [ FAIL ] :: refresh_mod_rule_host_to_mismatch (Expected 0, got 1) :: [ BEGIN ] :: refresh_mod_rule_host_to_match_before_smart :: actually running 'strict eval 'client_sudo_user_is_denied'' user1 is not in the sudoers file. This incident will be reported. :: [ FAIL ] :: refresh_mod_rule_host_to_match_before_smart (Expected 0, got 1) :: [ BEGIN ] :: refresh_mod_rule_host_to_match_after_smart :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_mod_rule_host_to_match_after_smart (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_command_to_mismatch :: actually running 'strict eval 'client_sudo_user_is_denied'' :: [ PASS ] :: refresh_mod_rule_command_to_mismatch (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_command_to_match :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_mod_rule_command_to_match (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_runasuser_to_mismatch :: actually running 'strict eval 'client_sudo_user_is_denied'' :: [ PASS ] :: refresh_mod_rule_runasuser_to_mismatch (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_runasuser_to_match :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_mod_rule_runasuser_to_match (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_runasgroup_to_mismatch :: actually running 'strict eval 'client_sudo_group_is_denied'' :: [ PASS ] :: refresh_mod_rule_runasgroup_to_mismatch (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_runasgroup_to_match :: actually running 'strict eval 'client_sudo_group_is_allowed'' :: [ PASS ] :: refresh_mod_rule_runasgroup_to_match (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_sudooption_to_require_auth :: actually running 'strict eval 'client_sudo_user_requires_auth'' :: [ PASS ] :: refresh_mod_rule_sudooption_to_require_auth (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_sudooption_to_not_require_auth :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_mod_rule_sudooption_to_not_require_auth (Expected 0, got 0) :: [ BEGIN ] :: refresh_del_rule :: actually running 'strict eval 'client_sudo_user_is_denied'' user1 is not in the sudoers file. This incident will be reported. :: [ FAIL ] :: refresh_del_rule (Expected 0, got 1) 'fd95a45f-0850-47ed-bfcb-e4e8b1a96930' refresh result: FAIL * Same set of tests with expected error message "user1 is not in the sudoers file". Some tests still give error "user1 is not allowed". :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: refresh :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ BEGIN ] :: refresh_add_rule_before_smart :: actually running 'strict eval 'client_sudo_user_is_denied'' :: [ PASS ] :: refresh_add_rule_before_smart (Expected 0, got 0) :: [ BEGIN ] :: refresh_add_rule_after_smart :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_add_rule_after_smart (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_user_to_mismatch :: actually running 'strict eval 'client_sudo_user_is_denied'' :: [ PASS ] :: refresh_mod_rule_user_to_mismatch (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_user_to_match_before_smart :: actually running 'strict eval 'client_sudo_user_is_denied'' :: [ PASS ] :: refresh_mod_rule_user_to_match_before_smart (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_user_to_match_after_smart :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_mod_rule_user_to_match_after_smart (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_host_to_mismatch :: actually running 'strict eval 'client_sudo_user_is_denied'' :: [ PASS ] :: refresh_mod_rule_host_to_mismatch (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_host_to_match_before_smart :: actually running 'strict eval 'client_sudo_user_is_denied'' MARK-LWD-LOOP -- 2016-03-09 07:24:20 -- :: [ PASS ] :: refresh_mod_rule_host_to_match_before_smart (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_host_to_match_after_smart :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_mod_rule_host_to_match_after_smart (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_command_to_mismatch :: actually running 'strict eval 'client_sudo_user_is_denied'' Sorry, user user1 is not allowed to execute '/bin/true' as user2 on ratchet.lab.eng.pnq.redhat.com. :: [ FAIL ] :: refresh_mod_rule_command_to_mismatch (Expected 0, got 1) :: [ BEGIN ] :: refresh_mod_rule_command_to_match :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_mod_rule_command_to_match (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_runasuser_to_mismatch :: actually running 'strict eval 'client_sudo_user_is_denied'' Sorry, user user1 is not allowed to execute '/bin/true' as user2 on ratchet.lab.eng.pnq.redhat.com. :: [ FAIL ] :: refresh_mod_rule_runasuser_to_mismatch (Expected 0, got 1) :: [ BEGIN ] :: refresh_mod_rule_runasuser_to_match :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_mod_rule_runasuser_to_match (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_runasgroup_to_mismatch :: actually running 'strict eval 'client_sudo_group_is_denied'' Sorry, user user1 is not allowed to execute '/bin/true' as user1:group_user2 on ratchet.lab.eng.pnq.redhat.com. :: [ FAIL ] :: refresh_mod_rule_runasgroup_to_mismatch (Expected 0, got 1) :: [ BEGIN ] :: refresh_mod_rule_runasgroup_to_match :: actually running 'strict eval 'client_sudo_group_is_allowed'' :: [ PASS ] :: refresh_mod_rule_runasgroup_to_match (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_sudooption_to_require_auth :: actually running 'strict eval 'client_sudo_user_requires_auth'' :: [ PASS ] :: refresh_mod_rule_sudooption_to_require_auth (Expected 0, got 0) :: [ BEGIN ] :: refresh_mod_rule_sudooption_to_not_require_auth :: actually running 'strict eval 'client_sudo_user_is_allowed'' :: [ PASS ] :: refresh_mod_rule_sudooption_to_not_require_auth (Expected 0, got 0) :: [ BEGIN ] :: refresh_del_rule :: actually running 'strict eval 'client_sudo_user_is_denied'' :: [ PASS ] :: refresh_del_rule (Expected 0, got 0) '8e084dbf-0d31-4bb3-adef-4b5115450107' refresh result: FAIL Actual results: Expected results: Additional info: Sudo debug logs RHEL 6.7 Mar 8 12:55:21 sudo[11108] <- set_cmnd @ ./sudoers.c:974 := 0 Mar 8 12:55:21 sudo[11108] -> sudo_sss_lookup @ ./sssd.c:1024 Mar 8 12:55:21 sudo[11108] -> sudo_sss_result_get @ ./sssd.c:773 Mar 8 12:55:21 sudo[11108] -> sudo_sss_checkpw @ ./sssd.c:374 Mar 8 12:55:21 sudo[11108] <- sudo_sss_checkpw @ ./sssd.c:386 := 0 Mar 8 12:55:21 sudo[11108] username=user1 Mar 8 12:55:21 sudo[11108] domainname=(null) + Mar 8 12:55:21 sudo[11108] state |= USERMATCH Mar 8 12:55:21 sudo[11108] Received 0 rule(s) Mar 8 12:55:21 sudo[11108] -> sudo_sss_filter_result @ ./sssd.c:181 Mar 8 12:55:21 sudo[11108] in_res=0x7fe7ff271e80, count=0, act=INCLUDE Mar 8 12:55:21 sudo[11108] emalloc: cnt=0 Mar 8 12:55:21 sudo[11108] <- sudo_sss_filter_result @ ./sssd.c:226 := 0x7fe7ff271e60 Mar 8 12:55:21 sudo[11108] u_sss_result=(0x7fe7ff271e80, 0) => f_sss_result=(0x7fe7ff271e60, 0) Mar 8 12:55:21 sudo[11108] Sorting the remaining entries using the sudoOrder attribute Mar 8 12:55:21 sudo[11108] <- sudo_sss_result_get @ ./sssd.c:840 := 0x7fe7ff271e60 Mar 8 12:55:21 sudo[11108] searching SSSD/LDAP for sudoers entries Mar 8 12:55:21 sudo[11108] Done with LDAP searches Mar 8 12:55:21 sudo[11108] sudo_sss_lookup(0)=0x40 ... Mar 8 12:55:21 sudo[11108] -> new_logline @ ./logging.c:746 Mar 8 12:55:21 sudo[11108] <- new_logline @ ./logging.c:867 := user NOT authorized on host ; TTY=p RHEL 6.8 Mar 8 13:00:58 sudo[917] <- set_cmnd @ ./sudoers.c:974 := 0 Mar 8 13:00:58 sudo[917] -> sudo_sss_lookup @ ./sssd.c:1032 Mar 8 13:00:58 sudo[917] -> sudo_sss_result_get @ ./sssd.c:781 Mar 8 13:00:58 sudo[917] -> sudo_sss_checkpw @ ./sssd.c:375 Mar 8 13:00:58 sudo[917] <- sudo_sss_checkpw @ ./sssd.c:387 := 0 Mar 8 13:00:58 sudo[917] username=user1 Mar 8 13:00:58 sudo[917] domainname=(null) Mar 8 13:00:59 sudo[917] Received 0 rule(s) Mar 8 13:00:59 sudo[917] -> sudo_sss_filter_result @ ./sssd.c:182 Mar 8 13:00:59 sudo[917] in_res=0x7f0cabdbee80, count=0, act=INCLUDE Mar 8 13:00:59 sudo[917] emalloc: cnt=0 Mar 8 13:00:59 sudo[917] <- sudo_sss_filter_result @ ./sssd.c:227 := 0x7f0cabdbee60 Mar 8 13:00:59 sudo[917] u_sss_result=(0x7f0cabdbee80, 0) => f_sss_result=(0x7f0cabdbee60, 0) Mar 8 13:00:59 sudo[917] Sorting the remaining entries using the sudoOrder attribute Mar 8 13:00:59 sudo[917] <- sudo_sss_result_get @ ./sssd.c:848 := 0x7f0cabdbee60 Mar 8 13:00:59 sudo[917] searching SSSD/LDAP for sudoers entries Mar 8 13:00:59 sudo[917] Done with LDAP searches Mar 8 13:00:59 sudo[917] sudo_sss_lookup(0)=0x60 ... Mar 8 13:00:59 sudo[917] -> new_logline @ ./logging.c:746 Mar 8 13:00:59 sudo[917] <- new_logline @ ./logging.c:867 := user NOT in sudoers ; TTY=pts/3 ; PWD=/var/lib/sss/db ; USER=user2 ; COMMAND=/bin/true