RHBA-2010:0852 - Bug Fix Advisory

Topic

An updated sssd package that addresses group assignment and multilib issues is
now available for Red Hat Enterprise Linux 6.

Description

The System Security Services Daemon (SSSD) provides a set of daemons to manage
access to remote directories and authentication mechanisms. It provides an NSS
and PAM interface toward the system and a pluggable backend system to connect to
multiple different account sources. It is also the basis to provide client
auditing and policy services for projects like FreeIPA.

These updated packages fix the following bugs:

• Previously, Kerberos applications running on the secondary architecture of a

multilib platform (e.g. i686 on x86_64) would not be able to identify the
Kerberos server for authentication. With this update, the Kerberos locator
plugin is located in the sssd-client package to allow installation of both the
32-bit and 64-bit versions on 64-bit systems. (BZ#637070)

• Previously, users would not always be assigned to all initgroups for which

they were a member in LDAP. This could cause several issues related to
group-based permissions. With this update, the initgroups() call always returns
all groups for the specified user. (BZ#642412)

• Previously, SSSD could remove legitimate groups that were only identified as a

user's primary group when the cache cleanup routine ran. This could cause issues
with group-based access control permissions such as access.conf and sudoers.
With this update, SSSD checks also whether there are users who have this group
as their primary group ID. (BZ#649312)

All SSSD users are advised to upgrade to these updated packages, which fix these
bugs.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 637070 - the krb5 locator plugin isn't packaged for multilib
• BZ - 642412 - SSSD initgroups does not behave as expected
• BZ - 649312 - SSSD will sometimes lose groups from the cache

CVEs

(none)

References

(none)