RHBA-2011:0925 - Bug Fix Advisory

Topic

Updated sssd packages that fix two bugs are now available for Red Hat Enterprise
Linux 6.

Description

The System Security Services Daemon (SSSD) provides a set of daemons to manage
access to remote directories and authentication mechanisms. It provides an NSS
(Name Service Switch) and PAM (Pluggable Authentication Modules) interface
toward the system and a pluggable back-end system to connect to multiple
different account sources. It is also the basis to provide client auditing and
policy services for projects such as FreeIPA.

This update fixes the following bugs:

• Previously, SSSD relied on the inotify kernel subsystem to detect whether a

DNS resolver file had been changed. If inotify returned an error (for example
due to resource exhaustion), SSSD terminated unexpectedly and network logins no
longer worked. With this update, SSSD itself detects the failure in the
described scenario and falls back to the five-second polling, fixing this bug.
(BZ#716905)

• When SSSD communicated with an OpenLDAP server, which supported server-side

password policies but did not list them in the "supportedControl" attribute of
the server's rootDSE entry, SSSD terminated unexpectedly with a segmentation
fault. This was a regression introduced in version 1.5.1-34.el6 of the sssd
package. An upstream patch has been provided to fix this bug. (BZ#716909)

All users of sssd are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure that all previously-released errata
relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.1 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.1 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.1 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.1 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.1 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.1 i386
• Red Hat Virtual Storage Appliance (from RHUI) 6.1 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 716905 - sssd shuts down if inotify crashes
• BZ - 716909 - libsss_ldap segfault at login against OpenLDAP

CVEs

(none)

References

(none)