Description of problem: we have our servers sudoers in ldap server. It worked perfectly until we updated sudo to 1.7.2p1-14.el5_8 ( released July 16 th ). The update somehow altered nsswitch.conf by removing the sudoers entry. Version-Release number of selected component (if applicable): 1.7.2p1-14.el5_8 How reproducible: 1. add a line to nsswitch.conf like sudoers: files ldap 2. update sudo to 1.7.2p1-14.el5_8 3. observe the file is altered and the entry is removed. Actual results: the sudoers entry in nsswitch.conf disappeared. Expected results: the sudoers entry stays as is. Additional info:
This is a bug in the %postun section. I'll provide a patch ASAP.
Created attachment 598915 [details] proposed patch
Created attachment 598933 [details] proposed and tested patch [root@rhel-5-usgcb tmp]# rpm -q sudo; grep sudoers: /etc/nsswitch.conf sudo-1.7.2p1-14.el5_8 sudoers: files ldap [root@rhel-5-usgcb tmp]# yum localinstall --nogpgcheck sudo-1.7.2p1-16.el5.x86_64.rpm Loaded plugins: katello, product-id, rhnplugin, security, subscription-manager Updating certificate-based repositories. Unable to read consumer identity Setting up Local Package Process Examining sudo-1.7.2p1-16.el5.x86_64.rpm: sudo-1.7.2p1-16.el5.x86_64 Marking sudo-1.7.2p1-16.el5.x86_64.rpm as an update to sudo-1.7.2p1-14.el5_8.x86_64 Resolving Dependencies --> Running transaction check ---> Package sudo.x86_64 0:1.7.2p1-16.el5 set to be updated --> Finished Dependency Resolution ... ... ... Complete! [root@rhel-5-usgcb tmp]# rpm -q sudo; grep sudoers: /etc/nsswitch.conf sudo-1.7.2p1-16.el5 sudoers: files ldap [root@rhel-5-usgcb tmp]#
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: Updating the sudo package resulted in the "sudoers" line in "/etc/nsswitch.conf" being removed. This update corrects the bug in the sudo package's post-uninstall script that caused this issue.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0112.html