RHBA-2015:0515 - Bug Fix Advisory

Topic

Updated sudo packages that fix several bugs and add one enhancement are now
available for Red Hat Enterprise Linux 7.

Description

The sudo packages contain the sudo utility which allows system administrators to
provide certain users with the permission to execute privileged commands, which
are used for system management purposes, without having to log in as root.

This update fixes the following bugs:

• Previously, the sudo utility did not correctly handle the "sudo -ll" command

when the System Security Services Daemon (SSSD) was used to obtain available
sudo entries. Consequently, running "sudo -ll" returned incomplete results, as
it did not list the rule names of sudo entries. A patch has been applied to fix
this bug, and "sudo -ll" now lists the rule names as expected when SSSD is used.
(BZ#1088464)

• When a sudo rule contained the +netgroup variable in the sudoUser attribute,

the system ignored the rest of the sudo rule under certain circumstances.
Consequently, executing the "sudo -l" command did not show the complete list of
rules configured for the specified user. With this update, the problem has been
fixed, and running "sudo -l" now shows the complete list of rules even when a
sudo rule contains the +netgroup variable. (BZ#1088825)

• Previously, sudo did not correctly handle the situation when the group

specification in the /etc/sudoers file contained escape characters on systems
integrated with the Active Directory (AD) service. As a consequence, specifying
a custom password prompt for a group containing escape characters did not work,
as sudo displayed the default password prompt when a member of that group used
sudo. A patch has been applied to fix this bug, and setting a custom password
prompt now works as expected even if the group specification contains escape
characters. (BZ#1092499)

• The pam_faillock module did not acknowledge attempts to terminate sudo login

with the Ctrl+C shortcut after the password prompt appeared. As a consequence,
sudo continued trying to log in and eventually locked the user out. The problem
has been fixed, and even though an attempt terminated with Ctrl+C still counts
as one failed attempt to log in, sudo no longer locks the user out. (BZ#1093099)

• Previously, sudo did not correctly handle setting the NIS domain name value as

"(none)", as it considered the "(none)" text string a valid domain name.
Consequently, the getdomainname() function returned "(none)" as the NIS domain
name instead of recognizing that no domain name was set. The source code has
been updated to fix this problem, and sudo now handles the described situation
correctly. (BZ#1096813)

• Previously, sudo did not correctly handle the situation when the

/etc/nsswitch.conf file contained the "sudoers: files sss sss" entry. As a
consequence, the duplicate "sss" entry caused sudo to become unresponsive after
issuing a command. With this update, the problem has been fixed, and sudo no
longer hangs when the configuration file contains "sudoers: files sss sss".
(BZ#1147497)

• Prior to this update, sudo did not respond correctly to the root user's

request to list the privileges for a specified user when SSSD was used. As a
consequence, running the "sudo -l -U" command for a normal user as root returned
incomplete results, while running the same command as the normal user worked as
expected. The source code has been updated to fix this problem, and executing
"sudo -l -U" as root now returns correct results. (BZ#1147557)

• The Clang static analyzer found a number of defects in the sudo packages. A

patch has been applied to fix these problems. (BZ#1147616)

In addition, this update adds the following enhancement:

• With this update, sudo has been modified to accept the ipa_hostname value from

the /etc/sssd/sssd.conf file when matching netgroups. (BZ#1084488)

Users of sudo are advised to upgrade to these updated packages, which fix these
bugs and add this enhancement.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 1147497 - duplicate sss module in nsswitch breaks sudo
• BZ - 1147557 - sudo -U <user> listing shows incorrect list when sssd is used.

CVEs

(none)

References

(none)