This bug has been migrated to another issue tracking site. It has been closed here and may no longer be being monitored.

If you would like to get updates for this issue, or to participate in it, you may do so at Red Hat Issue Tracker .
Bug 2121402 - GID in SudoUser entry does not work via SSSD provider
Summary: GID in SudoUser entry does not work via SSSD provider
Keywords:
Status: CLOSED MIGRATED
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: sudo
Version: 8.6
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Radovan Sroka
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-08-25 11:31 UTC by nbubakov
Modified: 2023-08-16 14:42 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 2121399
Environment:
Last Closed: 2023-08-16 14:42:03 UTC
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker   RHEL-1365 0 None None None 2023-08-16 14:42:02 UTC
Red Hat Issue Tracker RHELPLAN-132320 0 None None None 2022-08-25 11:55:16 UTC
Red Hat Issue Tracker SECENGSP-4734 0 None None None 2022-08-25 11:55:19 UTC

Description nbubakov 2022-08-25 11:31:08 UTC
Description of problem:
Sudo rule option SudoUser with group ID does not work via SSSD provider. But it works via LDAP.

Version-Release number of selected component (if applicable):
tested and failed on all RHEL8 and RHEL9

How reproducible:
Everytime

Steps to Reproduce:
1. setup sudo to use sssd, using this ldap data:

        # my-domain.com
	dn: dc=my-domain,dc=com
	objectClass: dcObject
	objectClass: organization
	dc: my-domain
	o: Test server
	
	# Groups, my-domain.com
	dn: ou=Groups,dc=my-domain,dc=com
	objectClass: top
	objectClass: organizationalunit
	ou: Groups
	
	# People, my-domain.com
	dn: ou=People,dc=my-domain,dc=com
	objectClass: top
	objectClass: organizationalunit
	ou: People
	
	# admin, People, my-domain.com
	dn: cn=admin,ou=People,dc=my-domain,dc=com
	objectClass: top
	objectClass: account
	objectClass: posixAccount
	cn: admin
	uidNumber: 11001
	gidNumber: 21001
	homeDirectory: /home/admin
	loginShell: /bin/bash
	uid: admin
	userPassword:: eA==
	
	# admin, Groups, my-domain.com
	dn: cn=admin,ou=Groups,dc=my-domain,dc=com
	gidNumber: 21001
	objectClass: top
	objectClass: posixGroup
	cn: 21001
	cn: admin
	
	# userallowed, People, my-domain.com
	dn: cn=userallowed,ou=People,dc=my-domain,dc=com
	objectClass: top
	objectClass: account
	objectClass: posixAccount
	cn: userallowed
	uidNumber: 10001
	gidNumber: 20001
	homeDirectory: /home/userallowed
	loginShell: /bin/bash
	uid: userallowed
	userPassword:: eA==
	
	# groupallowed, Groups, my-domain.com
	dn: cn=groupallowed,ou=Groups,dc=my-domain,dc=com
	gidNumber: 20001
	objectClass: top
	objectClass: posixGroup
	cn: groupallowed
	
	# usernotallowed, People, my-domain.com
	dn: cn=usernotallowed,ou=People,dc=my-domain,dc=com
	objectClass: top
	objectClass: account
	objectClass: posixAccount
	cn: usernotallowed
	uidNumber: 10002
	gidNumber: 20002
	homeDirectory: /home/usernotallowed
	loginShell: /bin/bash
	uid: usernotallowed
	userPassword:: eA==
	
	# groupnotallowed, Groups, my-domain.com
	dn: cn=groupnotallowed,ou=Groups,dc=my-domain,dc=com
	gidNumber: 20002
	objectClass: top
	objectClass: posixGroup
	cn: groupnotallowed
	
	# Sudoers, my-domain.com
	dn: ou=Sudoers,dc=my-domain,dc=com
	objectClass: top
	objectClass: organizationalUnit
	ou: Sudoers
	
	# defaults, Sudoers, my-domain.com
	dn: cn=defaults,ou=Sudoers,dc=my-domain,dc=com
	objectClass: top
	objectClass: sudoRole
	cn: defaults
	sudoOption: !authenticate
	sudoOption: !requiretty
	
	# rule1, Sudoers, my-domain.com
	dn: cn=rule1,ou=Sudoers,dc=my-domain,dc=com
	objectClass: top
	objectClass: sudoRole
	cn: rule1
	sudoHost: ALL
	sudoCommand: ALL
	sudoUser: %#20001

2. check it with following command:

	$ su - userallowed -c 'sudo true'

Actual results:
Gets generic error - exit status 1

Expected results:
userallowed is in the sudoers file - exit status 0

Additional info:

Comment 1 Radovan Sroka 2023-08-16 14:35:44 UTC
This bug is going to be migrated.

Contact point for migration questions or issues: rsroka
Guidance for Bugzilla users to test their Jira account or create one if needed:

https://redhat.service-now.com/help?id=kb_article_view&sysparm_article=KB0016394
https://redhat.service-now.com/help?id=kb_article_view&sysparm_article=KB0016694
https://redhat.service-now.com/help?id=kb_article_view&sysparm_article=KB0016774


Note You need to log in before you can comment on or make changes to this bug.