Bug 905340

+++ This bug was initially created as a clone of Bug #878030 +++

When a command is run via su from root, the exit status is always 0, even if the command fails.

For example : 

# service sssd status
sssd (pid  3009) is running...

# su - local_user -c "ls -8" ; echo $?
ls: invalid option -- '8'
Try `ls --help' for more information.
0

# service sssd stop
Stopping sssd:                                             [  OK  ]
# su - local_user -c "ls -8" ; echo $?
ls: invalid option -- '8'
Try `ls --help' for more information.
2

* User local_user is a local user (from /etc/passwd file)
* If we stop the sssd service(or remove pam_sss from pam 'session' section, then the command exit status is correct.

How reproducible:
Always
Version-Release number of selected component (if applicable): sssd-1.8.0-32.el6.x86_64


Steps to Reproduce:
1. Run, # su - local_user -c "ls -8" ; echo $? 
2. check the return value.

  
Actual results: su always returns 0

Expected results: su returns failure if the command fails.

--- Additional comment from Dmitri Pal on 2012-11-19 10:26:40 EST ---

Why this is an SSSD bug?
Does it behave correctly if pam_unix is used instead of pam_sss?

--- Additional comment from Jakub Hrozek on 2012-11-19 10:46:44 EST ---

We discussed the issue on IRC with Najmuddin. The problem is that the session stack of pam_sss doesn't check if the user it is processing is handled by the SSSD. We should check the existence of the user and return PAM_USER_UNKNOWN so that the pam stack carries on.

The simple workaround is to use pam_localuser.so

--- Additional comment from Jakub Hrozek on 2012-11-26 06:12:32 EST ---

Upstream ticket:
https://fedorahosted.org/sssd/ticket/1670

--- Additional comment from Jakub Hrozek on 2012-12-11 06:28:42 EST ---

*** Bug 886015 has been marked as a duplicate of this bug. ***

--- Additional comment from  on 2012-12-11 07:05:58 EST ---

(In reply to comment #4)
> *** Bug 886015 has been marked as a duplicate of this bug. ***

Can you send me a link how pam_localuser.so should be defined?

--- Additional comment from  on 2012-12-11 07:17:35 EST ---

I've checked the configuration and it looks that pam_localuser.so is defined:

---------------------

auth        required      pam_tally.so deny=5 onerr=fail file=/var/log/faillog no_magic_root
auth        required      pam_env.so
auth        sufficient    pam_unix.so try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet user ingroup La_KR_SRV_0007_AA
auth        sufficient    pam_sss.so use_first_pass
auth        required      pam_deny.so
#
account     required      pam_tally.so  deny=5 file=/var/log/faillog reset no_magic_root
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required      pam_permit.so
#
password    required      pam_cracklib.so retry=3 minlen=8 dcredit=0 ucredit=0 lcredit=0 ocredit=0 type=
password    sufficient    pam_unix.so remember=7 use_authtok md5 shadow
password    sufficient    pam_sss.so use_authtok
password    required      pam_deny.so
#
session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     sufficient    pam_sss.so
session     required      pam_unix.so

--- Additional comment from  on 2012-12-11 07:23:57 EST ---

and last but not least - when is it going to be fixed?

--- Additional comment from Najmuddin Chirammal on 2012-12-11 07:27:55 EST ---

(In reply to comment #6)
> I've checked the configuration and it looks that pam_localuser.so is defined:

You should add a 'pam_localuser.so' entry under "session" section, prior to pam_sss.

for eg: 


session     required      pam_mkhomedir.so umask=0022 skel=/etc/skel/
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     sufficient    pam_localuser.so  ## <-Add
session     sufficient    pam_sss.so
session     required      pam_unix.so

--- Additional comment from Jakub Hrozek on 2012-12-11 08:13:08 EST ---

(In reply to comment #7)
> and last but not least - when is it going to be fixed?

Currently scheduled for upstream 1.10 release. Please work with your support representative if you need this bug to be fixed sooner.