SSSD / sssd

#2266 SELinux user map is not applied to Active Directory users coming through IPA trust
Closed: Duplicate Opened by jhrozek.

Closed: Duplicate
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1071010

SSSD cannot apply SELinux user map for Active Directory users due to SELinux
rules being placed under AD domain's cn in sssd's cache but searched under IPA
domain's cn:
dn: cn=selinux,cn=ad.test,cn=sysdb
createTimestamp: 1393538073
lastUpdate: 1393538073
objectClass: selinux
order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-
s0:c0.c1023
user: unconfined_u:s0-s0:c0.c1023
distinguishedName: cn=selinux,cn=ad.test,cn=sysdb
dn: name=mymap,cn=selinux,cn=ad.test,cn=sysdb
createTimestamp: 1393538073
enabled: TRUE
lastUpdate: 1393538073
name: mymap
objectClass: selinuxusermap
originalDN: ipaUniqueID=81460176-9ec9-11e3-81c4-001a4ab8f505,cn=usermap,cn=seli
nux,dc=ipa7,dc=test
originalMemberUser: cn=adusers_u,cn=groups,cn=accounts,dc=ipa7,dc=test
selinuxUser: user_u:s0
uniqueID: 81460176-9ec9-11e3-81c4-001a4ab8f505
distinguishedName: name=mymap,cn=selinux,cn=ad.test,cn=sysdb
but
(Thu Feb 27 23:54:36 2014) [sssd[be[ipa7.test]]] [sysdb_search_groups]
(0x2000): Search groups with filter: (&(objectclass=group)(originalDN=ipaunique
id=81460176-9ec9-11e3-81c4-001a4ab8f505,cn=usermap,cn=selinux,dc=ipa7,dc=test))
(Thu Feb 27 23:54:36 2014) [sssd[be[ipa7.test]]] [sysdb_search_groups]
(0x2000): No such  entry
(Thu Feb 27 23:54:36 2014) [sssd[be[ipa7.test]]] [add_ad_user_to_cached_groups]
(0x4000): Group
  [ipauniqueid=81460176-9ec9-11e3-81c4-001a4ab8f505,cn=usermap,cn=selinux,dc=ip
a7,dc=test] not in the cache.
  (Thu Feb 27 23:54:36 2014) [sssd[be[ipa7.test]]]
[ipa_add_ad_memberships_get_next] (0x0020): There are unresolved external group
memberships even after all groups have been looked up on the LDAP server.
Note that it looks up objectclass=group while it should lookup
objectclass=selinuxusermap and take originalMemberUser from there.
This is for the following configuration:
[root@rh7-01 ~]# ipa group-show adusers
   Group name: adusers
   Description: AD users
   Member of groups: adusers_u
   External member: domain admins@ad.test
[root@rh7-01 ~]# ipa group-show adusers_u
   Group name: adusers_u
   Description: POSIX group for AD users
   GID: 487000006
   Member groups: adusers
[root@rh7-01 ~]# ipa selinuxusermap-show mymap
   Rule name: mymap
   SELinux User: user_u:s0
   Enabled: TRUE
   User Groups: adusers_u
Here is what I see when log in as AD user:
[ab@rh7-01 ~]$ klist
Ticket cache: KEYRING:persistent:1000:1000
Default principal: Administrator@AD.TEST
Valid starting       Expires              Service principal
02/27/2014 23:52:37  02/28/2014 09:52:09  host/rh7-01.ipa7.test@IPA7.TEST
        renew until 02/28/2014 23:52:06
02/27/2014 23:52:33  02/28/2014 09:52:09  krbtgt/IPA7.TEST@AD.TEST
        renew until 02/28/2014 23:52:06
02/27/2014 23:52:09  02/28/2014 09:52:09  krbtgt/AD.TEST@AD.TEST
        renew until 02/28/2014 23:52:06
[ab@rh7-01 ~]$ ssh -k -l Administrator@AD.TEST `hostname`
Last login: Fri Feb 28 00:32:12 2014 from rh7-01.ipa7.test
-sh-4.2$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-sh-4.2$ id
uid=1115000500(administrator@ad.test) gid=1115000500(administrator@ad.test)
groups=1115000500(administrator@ad.test),487000006(adusers_u),1115000512(domain
admins@ad.test),1115000513(domain users@ad.test),1115000518(schema
admins@ad.test),1115000519(enterprise admins@ad.test),1115000520(group policy
creator owners@ad.test)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
-sh-4.2$

Fields changed

blockedby: =>
blocking: =>
changelog: =>
coverity: =>
design: =>
design_review: => 0
feature_milestone: =>
fedora_test_page: =>
owner: somebody => jhrozek
review: True => 0
selected: =>
status: new => assigned
testsupdated: => 0

As per discussion in the downstream BZ, we need to change the format we use to write the SELinux login file to the output format we'd use as output of getpwnam()

owner: jhrozek => mzidek
status: assigned => new

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.11.5
owner: mzidek => jhrozek
patch: 0 => 1

There was a bit of a confusion about what pam_selinux should do and what sssd should do. The sssd part was tracked with #2282 after all. Closing.

resolution: => duplicate
status: new => closed

Metadata Update from @jhrozek:
- Issue assigned to jhrozek
- Issue set to the milestone: SSSD 1.11.5

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/3308

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
Normal
defect
SSSD
0
1
https://bugzilla.redhat.com/show_bug.cgi?id=1071010
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.