Bug 1653023 - PAM update in F30 breaks sudo
Summary: PAM update in F30 breaks sudo
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: pam
Version: rawhide
Hardware: All
OS: Linux
high
urgent
Target Milestone: ---
Assignee: Björn 'besser82' Esser
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: F30BetaBlocker
TreeView+ depends on / blocked
 
Reported: 2018-11-24 16:20 UTC by Stephen Gallagher
Modified: 2018-11-25 13:37 UTC (History)
7 users (show)

Fixed In Version: pam-1.3.1-10.fc30
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-11-25 13:37:47 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Github linux-pam linux-pam pull 80 None None None 2018-11-25 13:08:22 UTC

Description Stephen Gallagher 2018-11-24 16:20:16 UTC
Description of problem:
After updating pam to 1.3.1-9.fc30, sudo fails with the error "sudo: Password expired, contact your system administrator"

Version-Release number of selected component (if applicable):
pam-1.3.1-9.fc30

How reproducible:
Every time

Steps to Reproduce:
0. `sudo podman pull registry.fedoraproject.org/fedora:rawhide`
1. `sudo podman run  --privileged -i --tty --rm --name f30_pam registry.fedoraproject.org/fedora:rawhide`
2. (Inside container) `dnf -y install sudo`
3. (Inside container) `sudo ls`
4. (Inside container) `dnf -y update pam`
5. (Inside container) `sudo ls`

Actual results:
The first sudo works fine. After updating PAM, it returns "sudo: Password expired, contact your system administrator"

Expected results:
sudo should work properly after the PAM update.

Additional info:
This is breaking the CI setup for libmodulemd, among other things.

Comment 1 Fedora Blocker Bugs Application 2018-11-24 16:24:13 UTC
Proposed as a Blocker for 30-beta by Fedora user sgallagh using the blocker tracking app because:

 I'm not sure which specific criterion to cite, as non-functional "sudo" breaks a huge swath of administrative functionality.

I suppose "The installed system must be able appropriately to install, remove, and update software with the default console tool for the relevant software type (e.g. default console package manager). This includes downloading of packages to be installed/updated." might be appropriate, since if you didn't set a root password in Anaconda, it will be impossible to run `dnf install` or `dnf update`.

Comment 2 Lukas Slebodnik 2018-11-24 18:36:34 UTC
And a little bit more verbose output

Before upgrade:
[build@4ed54a2218eb tmp]$ sudo su -c "ls /root"
anaconda-ks.cfg  anaconda-post.log  original-ks.cfg
[build@4ed54a2218eb tmp]$ sudo -l
Matching Defaults entries for build on 4ed54a2218eb:
    !visiblepw, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR
    LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS
    LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT
    LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER
    LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
    XAUTHORITY",
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bi
n

User build may run the following commands on 4ed54a2218eb:
    (ALL : ALL) NOPASSWD: /usr/bin/dnf --assumeyes --best
        --setopt\=install_weak_deps\=False install -- *


Upgrade:
[build@4ed54a2218eb tmp]$ sudo su -c "dnf update -y pam\*"
Last metadata expiration check: 0:01:07 ago on Sat Nov 24 18:32:24 2018.
Dependencies resolved.
================================================================================
 Package           Arch           Version                 Repository       Size
================================================================================
Upgrading:
 pam               x86_64         1.3.1-9.fc30            rawhide         629 k
 pam-devel         x86_64         1.3.1-9.fc30            rawhide         148 k

Transaction Summary
================================================================================
Upgrade  2 Packages

Total download size: 778 k
Downloading Packages:
(1/2): pam-devel-1.3.1-9.fc30.x86_64.rpm         65 kB/s | 148 kB     00:02
(2/2): pam-1.3.1-9.fc30.x86_64.rpm              204 kB/s | 629 kB     00:03
--------------------------------------------------------------------------------
Total                                           252 kB/s | 778 kB     00:03
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1
  Upgrading        : pam-1.3.1-9.fc30.x86_64                                1/4
  Running scriptlet: pam-1.3.1-9.fc30.x86_64                                1/4
  Upgrading        : pam-devel-1.3.1-9.fc30.x86_64                          2/4
  Cleanup          : pam-devel-1.3.1-8.fc30.x86_64                          3/4
  Cleanup          : pam-1.3.1-8.fc30.x86_64                                4/4
  Running scriptlet: pam-1.3.1-8.fc30.x86_64                                4/4
  Verifying        : pam-1.3.1-9.fc30.x86_64                                1/4
  Verifying        : pam-1.3.1-8.fc30.x86_64                                2/4
  Verifying        : pam-devel-1.3.1-9.fc30.x86_64                          3/4
  Verifying        : pam-devel-1.3.1-8.fc30.x86_64                          4/4

Upgraded:
  pam-1.3.1-9.fc30.x86_64             pam-devel-1.3.1-9.fc30.x86_64

Complete!


And broken after upgrade:
[build@4ed54a2218eb tmp]$ sudo -l
Matching Defaults entries for build on 4ed54a2218eb:
    !visiblepw, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR
    LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS
    LC_CTYPE", env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT
    LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER
    LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
    XAUTHORITY",
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User build may run the following commands on 4ed54a2218eb:
    (ALL : ALL) NOPASSWD: /usr/bin/dnf --assumeyes --best
        --setopt\=install_weak_deps\=False install -- *
    (ALL : ALL) NOPASSWD: /bin/su
[build@4ed54a2218eb tmp]$ sudo su -c "ls /root"
sudo: pam_open_session: System error
sudo: policy plugin failed session initialization

Comment 3 Lukas Slebodnik 2018-11-24 20:37:53 UTC
(In reply to Stephen Gallagher from comment #0)
> Actual results:
> The first sudo works fine. After updating PAM, it returns "sudo: Password
> expired, contact your system administrator"
> 

In both cases, it happens in container and I can say that build user does not have any password. It works well if user has passwod but use is used with NOPASSWD so it is not required.

Comment 4 Björn 'besser82' Esser 2018-11-25 06:41:30 UTC
Can you please check and confirm the issue is solved (and no other regressions are introduced) with this [1] scratch build?


[1]  https://koji.fedoraproject.org/koji/taskinfo?taskID=31094383

Comment 5 Stephen Gallagher 2018-11-25 13:15:05 UTC
I can confirm that the scratch-build fixes this issue. Can we get that into a proper build ASAP? As noted in the original post, numerous CI systems depend on sudo working on the Rawhide container image, so it would be good to land this in the Rawhide compose right away (and adjust it later if the upstream review results in changes).

Comment 6 Björn 'besser82' Esser 2018-11-25 13:37:47 UTC
Thank you for testing and confirming the fix, Stephen!

"Real" build for Rawhide is running.  I just wanted to wait for an external confirmation before pulling the trigger.


Note You need to log in before you can comment on or make changes to this bug.