RHBA-2018:1144 - Bug Fix Advisory

Topic

Updated sssd packages that fix several bugs are now available for Red Hat
Enterprise Linux 7.4 Extended Update Support.

Description

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.

This update fixes the following bugs:

• Previously, the krb5_child helper process that communicates with a Kerberos Key Distribution Centre (KDC) on behalf of the user returned a special libkrb5 error code if the ticket it was operating with had expired. Consequently, when System Security Services Daemon (SSSD) tried to renew the ticket, the unhandled error code set SSSD into offline mode. With this update, the libkrb5 error code has been mapped onto a different internal SSSD error that is handled correctly. As a result, SSSD no longer switches into offline mode when attempting to renew an expired ticket. (BZ#1545879)
• Previously, due to a wrong memory hierarchy in the network security service (NSS) responder, the memory that was needed for printing a specific name was allocated to a permanent memory context. As a consequence, the memory usage of the sssd_nss service kept growing. This update allocates the memory to a correct operation context and the memory usage of sssd_nss no longer grows. (BZ#1546064)
• Previously, due to a wrong memory hierarchy in the active directory (AD) provider, the memory that was needed to connect to a specific server was allocated to a permanent memory context. As a consequence, the memory usage of the sssd_be service kept growing for configurations using the 'id_provider=ad' parameter. This update allocates the memory to a correct operation context and the memory usage of sssd_be no longer grows. (BZ#1549674)
• Previously, System Security Services Daemon (SSSD) sometimes behaved incorrectly when processing a built-in Active Directory (AD) group while saving the group hierarchy: SSSD saved the built-in AD group without assigning it any GID instead of skipping it as expected. Consequently, when other parts of SSSD such as the Simple Access Provider encountered the group with no GID, they raised an error. With this update, SSSD no longer caches any built-in AD groups. As a result, problems with SSSD and built-in AD groups no longer occur. (BZ#1549675)
• Previously, the SSSD auth-to-local Kerberos plug-in returned an incorrect output message "KRB5_PLUGIN_NO_HANDLE" if it could not find mapping for the principal. As a consequence, the libkrb5 package could not continue with another auth-to-local ruleset. This update fixes SSSD auth-to-local to return a correct output message "KRB5_LNAME_NOTRANS". As a result, libkrb5 can use SSSD auth-to-local mapping rules from its configuration file even if no rules have been defined by the SSSD match. (BZ#1559288)

Users of sssd are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64

Fixes

• BZ - 1546064 - sssd_nss consumes more memory until restarted or machine swaps [rhel-7.4.z]
• BZ - 1559288 - sssd_krb5_localauth_plugin fails to fallback to other localname rules [rhel-7.4.z]

CVEs

(none)

References

(none)