Red Hat Bugzilla – Bug 902716
Rule mismatch isn't noticed before smart refresh on ppc64 and s390x
Last modified: 2013-02-21 04:43:49 EST
Description of problem: SSSD doesn't notice rule becoming a mismatch immediately, but only after a smart refresh on ppc64 and s390x with directory server running on x86_64. Version-Release number of selected component (if applicable): sssd-client-1.9.2-74.el6.s390x libsss_idmap-1.9.2-74.el6.s390x libsss_sudo-1.9.2-74.el6.s390x sssd-1.9.2-74.el6.s390x How reproducible: always Steps to Reproduce: 1. Setup LDAP directory, using the attached mismatch_refresh_test.ldif file as reference. 2. Setup SSSD client using the attached sssd.conf as reference. 3. Execute the following, replacing the server hostname: ---:<--- service sssd restart >/dev/null ldapmodify -h dell-pe840-01.rhts.eng.bos.redhat.com -x -D cn=Manager,dc=example,dc=com -w Secret123 <<<" dn: cn=test,ou=Sudoers,dc=example,dc=com replace: sudoUser sudoUser: user2" >/dev/null su -c 'sudo -u user2 true' user1 && echo ALLOWED || echo DENIED sleep 11 su -c 'sudo -u user2 true' user1 && echo ALLOWED || echo DENIED --->:--- Actual results: ALLOWED user1 is not allowed to run sudo on ibm-z10-02. This incident will be reported. DENIED Expected results: user1 is not allowed to run sudo on ibm-z10-02. This incident will be reported. DENIED user1 is not allowed to run sudo on ibm-z10-02. This incident will be reported. DENIED Additional info: This works as documented on x86_64 and i386. Use the following command for test teardown, replacing the server hostname: ---:<--- ldapmodify -h dell-pe840-01.rhts.eng.bos.redhat.com -x -D cn=Manager,dc=example,dc=com -w Secret123 <<<" dn: cn=test,ou=Sudoers,dc=example,dc=com replace: sudoUser sudoUser: user1" >/dev/null --->:---
Created attachment 685018 [details] mismatch_refresh_test.ldif
Created attachment 685019 [details] sssd.conf
Created attachment 685034 [details] mismatch_refresh_test.ldif
I'd say this bug could lead to a security issue, where an administrator would expect access right revocation to become effective immediately on ppc64 or s390x, similarly to what happens on i386 or x86_64, and not only after smart refresh interval, which could be set noticeably long.
Upstream ticket: https://fedorahosted.org/sssd/ticket/1779
Hi, can you please attach logs? Also, would you be so kind as to prepare me test environment on these architectures? Thanks.
(In reply to comment #7) > Hi, > can you please attach logs? Also, would you be so kind as to prepare me test > environment on these architectures? Thanks. Details on reproduction environment were passed on IRC.
Verified as fixed with the following packages: sssd-client-1.9.2-82.el6.s390x libsss_idmap-1.9.2-82.el6.s390x sssd-1.9.2-82.el6.s390x libsss_sudo-1.9.2-82.el6.s390x Relevant sudo suite output: :: [ PASS ] :: refresh_mod_rule_user_to_mismatch
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0508.html