RHBA-2017:0078 - Bug Fix Advisory

Topic

Updated sssd packages that fix several bugs are now available for Red Hat Enterprise Linux 7.

Description

The System Security Services Daemon (SSSD) provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system and a pluggable back-end system to connect to multiple different account sources.

This update fixes the following bugs:

• Due to an update in Red Hat Enterprise Linux 7.3, in a case-insensitive domain, the sudoUser attribute only matched the lowercase version of the LDAP user or group name. As a consequence, configurations using case-insensitive sudoUser attribute values failed. This update re-enables SSSD to match the sudoUser attribute regardless of case and now both lowercase and case-sensitive can be configured. (BZ#1392946)
• Previously, the System Security Services Daemon (SSSD) only used the domain name set in the /etc/sssd/sssd.conf file to match found entries if multiple entries matched the search result. Consequently, if two users with the same sAMAccountName attribute were present in two nested Active Directory (AD) domains and the domain name set in the /etc/sssd/sssd.conf file was different than the AD domain name, SSSD failed to resolve supplementary groups for these accounts. SSSD now uses the domain name set in the configuration file and additionally the remote domain name. As a result, secondary groups are now resolved correctly. (BZ#1393730)
• Previously, if the "ipa" or "ad" subdomain provider was set in the /etc/sssd/sssd.conf file, the System Security Services Daemon (SSSD) accessed only data that the respective authentication provider sets up. As a consequence, if the user configured the "ipa" or "ad" subdomain provider with a different authentication provider, SSSD accessed uninitialized memory and terminated unexpectedly. A patch has been applied and SSSD now only accesses data if the same authentication and subdomain provider are configured. As a result, SSSD no longer fails in the described scenario. (BZ#1396485)
• Previously, the Security Services Daemon (SSSD) did not store group names and group member names correctly if the ldap_nesting_level parameter was set to 0 in the /etc/sssd/sssd.conf file. As a consequence, resolving group members or group names failed. A patch has been applied to fix the problem and as a result, SSSD now works correctly in setups have the LDAP nesting level set to 0. (BZ#1396486)
• The System Security Services Daemon's (SSSD) cache in Red Hat Enterprise Linux 7.3 uses a different format to store user and group names than previous versions. SSSD automatically migrates the cache when the service is started after updating to Red Hat Enterprise Linux 7.3. However, on clients with a large cache, the migration can take a long time and as a consequence, the SSSD process watchdog terminated the process and the service failed to start. This update disables the watchdog for the "sssd" process and as a result, large caches are now successfully migrated and SSSD starts correctly. (BZ#1398169)
• Previously, if the System Security Services Daemon (SSSD) failed to contact the autofs LDAP data provider, the autofs responder did not return data that was already cached locally. To fix the problem, the autofs responder has been updated and as a result, SSSD now returns cached autofs data if the LDAP server is not available. (BZ#1398673)
• Previously, if the socket that the System Security Services Daemon (SSSD) uses to communicate with the DNS server was writable and readable, and additionally an error occurred while processing the first event, SSSD accessed freed memory and the service terminated unexpectedly. A patch has been applied and SSSD now processes both events using the same resolver callback call. As a result, SSSD no longer fails in the described scenario. (BZ#1404340)

Users of sssd are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1392946 - sudo: ignore case on case insensitive domains
• BZ - 1393730 - No supplementary groups are resolved for users in nested OUs when domain stanza differs from AD domain
• BZ - 1396485 - sssd_be keeps crashing if id_provider=ad or ipa and auth_provider=krb5
• BZ - 1398673 - autofs map resolution doesn't work offline
• BZ - 1404340 - Use-after free in resolver in case the fd is writeable and readable at the same time

CVEs

(none)

References

(none)