November 2024 - Sssd-maintainers - Fedora mailing-lists

[Bug 2319608] New: python3-sssdconfig packs outdated .pyc files
by bugzilla＠redhat.com 07 Dec '24

07 Dec '24

https://bugzilla.redhat.com/show_bug.cgi?id=2319608 Bug ID: 2319608 Summary: python3-sssdconfig packs outdated .pyc files Product: Fedora Version: rawhide OS: Linux Status: NEW Component: sssd Keywords: Regression Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: jpazdziora(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora The /usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/*.cpython-313.pyc /usr/lib/files get regenerated when SSSDConfig module is used. Reproducible: Always Steps to Reproduce: 1. dnf install -y python3-sssdconfig 2. stat /usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc 3. python3 -c 'import SSSDConfig' 4. stat /usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc Actual Results: [root@0890eef375bc /]# stat /usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc File: /usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc Size: 57759 Blocks: 120 IO Block: 4096 regular file Device: 0,109 Inode: 1226072 Links: 2 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2024-10-15 00:00:00.000000000 +0000 Modify: 2024-10-15 00:00:00.000000000 +0000 Change: 2024-10-18 09:46:42.433097566 +0000 Birth: 2024-10-18 09:46:42.432097551 +0000 [root@0890eef375bc /]# python3 -c 'import SSSDConfig' [root@0890eef375bc /]# stat /usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc File: /usr/lib/python3.13/site-packages/SSSDConfig/__pycache__/__init__.cpython-313.pyc Size: 59402 Blocks: 120 IO Block: 4096 regular file Device: 0,109 Inode: 1196042 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2024-10-18 09:47:14.646592272 +0000 Modify: 2024-10-18 09:47:14.646592272 +0000 Change: 2024-10-18 09:47:14.646592272 +0000 Birth: 2024-10-18 09:47:14.646592272 +0000 Expected Results: The Size and Modify time in the second stat run should match the output from the first one. First found by https://github.com/freeipa/freeipa-container/actions/runs/11397511703/job/3…. -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2319608 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 8

[Bug 2299722] New: SELinux preventing password authentication
by bugzilla＠redhat.com 02 Dec '24

02 Dec '24

https://bugzilla.redhat.com/show_bug.cgi?id=2299722 Bug ID: 2299722 Summary: SELinux preventing password authentication Product: Fedora Version: rawhide Status: NEW Component: sssd Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: orion(a)nwra.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: We're seeing SELinux preventing password authentication: In permissive mode it works and we see: type=AVC msg=audit(1721842903.063:1198): avc: denied { read } for pid=31553 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721842903.064:1199): avc: denied { view } for pid=31553 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721842903.064:1200): avc: denied { write } for pid=31553 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721842989.327:1210): avc: denied { read } for pid=31647 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 type=AVC msg=audit(1721843092.725:1229): avc: denied { read } for pid=31751 comm="krb5_child" scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:system_r:cifs_helper_t:s0 tclass=key permissive=1 krb5_child.log shows: (2024-07-24 9:54:32): [krb5_child[30625]] [set_lifetime_options] (0x0100): [RID#771] No specific renewable lifetime requested. (2024-07-24 9:54:32): [krb5_child[30625]] [set_lifetime_options] (0x0100): [RID#771] No specific lifetime requested. (2024-07-24 9:54:32): [krb5_child[30625]] [set_canonicalize_option] (0x0100): [RID#771] Canonicalization is set to [true] (2024-07-24 9:54:34): [krb5_child[30625]] [create_ccache] (0x0020): [RID#771] 1548: [13][Permission denied] Version-Release number of selected component (if applicable): sssd-2.9.5-1.fc39.x86_64 selinux-policy-39.7-1.fc39.noarch How reproducible: Unsure -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2299722 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 9

[Bug 2320042] New: [abrt] sssd-tools: set_component(): source_files.py:73:set_component:OSError
by bugzilla＠redhat.com 26 Nov '24

26 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2320042 Bug ID: 2320042 Summary: [abrt] sssd-tools: set_component(): source_files.py:73:set_component:OSError Product: Fedora Version: 41 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:a5a6dd78a14a8d86bce922d86636e1cb2da53ec6;VAR IANT_ID=workstation; Component: sssd Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: maxi(a)maxiicodes.dev QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Version-Release number of selected component: sssd-tools-2.10.0-1.fc41 Additional info: reporter: libreport-2.17.15 kernel: 6.11.4-300.fc41.x86_64 cmdline: /usr/bin/python3 -sP /usr/libexec/sssd/sss_analyze error list cgroup: 0::/user.slice/user-1000.slice/user@1000.service/app.slice/app-cosmic-com.system76.CosmicAppList-3787.scope uid: 1000 reason: source_files.py:73:set_component:OSError executable: /usr/libexec/sssd/sss_analyze type: Python3 package: sssd-tools-2.10.0-1.fc41 runlevel: N 5 exception_type: OSError crash_function: set_component interpreter: python3-3.13.0-1.fc41.x86_64 Truncated backtrace: source_files.py:73:set_component:OSError Traceback (most recent call last): File "/usr/libexec/sssd/sss_analyze", line 5, in <module> sss_analyze.run() ~~~~~~~~~~~~~~~^^ File "/usr/lib/python3.13/site-packages/sssd/sss_analyze.py", line 107, in run analyzer.main() ~~~~~~~~~~~~~^^ File "/usr/lib/python3.13/site-packages/sssd/sss_analyze.py", line 102, in main args.func(args) ~~~~~~~~~^^^^^^ File "/usr/lib/python3.13/site-packages/sssd/modules/error.py", line 52, in print_error source.set_component(component, False) ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.13/site-packages/sssd/source_files.py", line 73, in set_component raise IOError OSError Local variables in innermost frame: self: <sssd.source_files.Files object at 0x7f0cd2976e40> component: <Component.BE: 3> child: False domains: [] -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2320042 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 6

[Bug 2326918] gdm-smartcard PAM unable to dlopen(/usr/lib64/security/pam_console.so)
by bugzilla＠redhat.com 18 Nov '24

18 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2326918 --- Comment #11 from Sumit Bose <sbose(a)redhat.com> --- Hi, about your confusion with LUKS2, it looks like LUKS2 is only using the private key stored on the Nitrokey and is initially only referring to the certificate to locate the matching private key. As long as you have regenerated the certificate with the same public and private key than the old certificate the private key stored on the Nitrokey didn't change and as a result you do not have to re-enroll it. HTH bye, Sumit -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2326918 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2326918] gdm-smartcard PAM unable to dlopen(/usr/lib64/security/pam_console.so)
by bugzilla＠redhat.com 18 Nov '24

18 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2326918 Ralf Schneider <ralf.schneider(a)ra-s.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Flags|needinfo?(ralf.schneider@ra | |-s.org) | Resolution|--- |NOTABUG Last Closed| |2024-11-18 18:22:08 --- Comment #10 from Ralf Schneider <ralf.schneider(a)ra-s.org> --- (In reply to Alexey Tikhonov from comment #9) > And could you please also check if > `/usr/share/polkit-1/rules.d/sssd-pcsc.rules` file is present on your system? (In reply to Alexey Tikhonov from comment #8) > (In reply to Ralf Schneider from comment #0) > > > > (2024-11-18 9:35:29): [pam] [child_sig_handler] (0x0100): [CID#16] child [13272] finished successfully. > > (2024-11-18 9:35:29): [pam] [_read_pipe_handler] (0x0400): [CID#16] EOF received, client finished > > (2024-11-18 9:35:29): [pam] [parse_p11_child_response] (0x1000): [CID#16] No certificate found. > > Could you please attach corresponding part of '/var/log/sss/p11_child.log'? Hi all thanks a lot for the quick responses and sorry about digging through the wrong logs. /var/log/sssd/p11_child.log tells (2024-11-18 17:17:13): [p11_child[11266]] [do_verification] (0x0040): [CID#20] X509_verify_cert failed [0]. (2024-11-18 17:17:13): [p11_child[11266]] [do_verification] (0x0040): [CID#20] X509_verify_cert failed [10][certificate has expired]. So doing an openssl ca -config ca.cnf -batch -notext -keyfile rootCA.key -in user.csr -days <no_days> -extensions usr_cert -out new_cert.crt pkcs15-init --update-certificate new_cert.crt --auth-id $AUTH_ID --id $ID --format pem did the trick. Now everything works again as expected. Updating to Fedora 41 at the same time as my user certificate expired was really another prime example of Murphy's Law. What was indeed confusing was the fact that unlocking LUKS2 with X509 certificate on Nitrokey Storage, which I implemented as per https://vtimofeenko.com/posts/unlocking-luks2-with-x509-certificate-on-nitr…, still worked and is still working even though I have not enrolled the new certificate on the luks device. Sorry again for all the confusion & thanks a lot for the quick help. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2326918 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2326918] gdm-smartcard PAM unable to dlopen(/usr/lib64/security/pam_console.so)
by bugzilla＠redhat.com 18 Nov '24

18 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2326918 --- Comment #9 from Alexey Tikhonov <atikhono(a)redhat.com> --- And could you please also check if `/usr/share/polkit-1/rules.d/sssd-pcsc.rules` file is present on your system? -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2326918 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2326918] gdm-smartcard PAM unable to dlopen(/usr/lib64/security/pam_console.so)
by bugzilla＠redhat.com 18 Nov '24

18 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2326918 Alexey Tikhonov <atikhono(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(ralf.schneider@ra | |-s.org) --- Comment #8 from Alexey Tikhonov <atikhono(a)redhat.com> --- (In reply to Ralf Schneider from comment #0) > > (2024-11-18 9:35:29): [pam] [child_sig_handler] (0x0100): [CID#16] child [13272] finished successfully. > (2024-11-18 9:35:29): [pam] [_read_pipe_handler] (0x0400): [CID#16] EOF received, client finished > (2024-11-18 9:35:29): [pam] [parse_p11_child_response] (0x1000): [CID#16] No certificate found. Could you please attach corresponding part of '/var/log/sss/p11_child.log'? -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2326918 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2326918] gdm-smartcard PAM unable to dlopen(/usr/lib64/security/pam_console.so)
by bugzilla＠redhat.com 18 Nov '24

18 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2326918 Iker Pedrosa <ipedrosa(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|pam |sssd Assignee|ipedrosa(a)redhat.com |sbose(a)redhat.com CC| |abokovoy(a)redhat.com, | |atikhono(a)redhat.com, | |lslebodn(a)redhat.com, | |mzidek(a)redhat.com, | |pbrezina(a)redhat.com, | |sbose(a)redhat.com, | |ssorce(a)redhat.com, | |sssd-maintainers(a)lists.fedo | |raproject.org --- Comment #7 from Iker Pedrosa <ipedrosa(a)redhat.com> --- So pam_console was not the problem, I thought it wasn't, but I wanted to make sure. Sumit can I get your eyes on this issue? It seems like the certificate disappeared from the smartcard. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2326918 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2320133] New: When installing sssd-ipa package in rpm-ostree image, selinux_child loses capabilities defined in the RPM package
by bugzilla＠redhat.com 16 Nov '24

16 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2320133 Bug ID: 2320133 Summary: When installing sssd-ipa package in rpm-ostree image, selinux_child loses capabilities defined in the RPM package Product: Fedora Version: 41 OS: Linux Status: NEW Component: sssd Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: abokovoy(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora If rpm-ostree-based image includes sssd-ipa, the resulting /usr/libexec/sssd/selinux_child does not have expected file capabilities present: # getcap -v /usr/libexec/sssd/*child /usr/libexec/sssd/gpo_child /usr/libexec/sssd/krb5_child cap_chown,cap_dac_override,cap_setgid,cap_setuid=ep /usr/libexec/sssd/ldap_child cap_chown,cap_dac_override,cap_setgid,cap_setuid=ep /usr/libexec/sssd/oidc_child /usr/libexec/sssd/p11_child /usr/libexec/sssd/passkey_child /usr/libexec/sssd/proxy_child /usr/libexec/sssd/selinux_child The capabilities are present in the RPM database: $ rpm -q --filecaps sssd-ipa | grep selinux_child /usr/libexec/sssd/selinux_child cap_chown,cap_dac_override,cap_setgid,cap_setuid=ep Lack of capabilities on the selinux_child causes PAM account phase to fail: (2024-10-21 10:11:05): [be[example.test]] [selinux_child_done] (0x0020): [RID#5] selinux_child_parse_response failed: [22][Invalid argument] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-10-21 10:11:05): [be[example.test]] [sdap_handle_release] (0x2000): Trace: sh[0x56040e7054d0], connected[1], ops[(nil)], ldap[0x56040e74efb0], destructor_lock[0], release_memory[0] * (2024-10-21 10:11:05): [be[example.test]] [remove_connection_callback] (0x4000): Successfully removed connection callback. * (2024-10-21 10:11:05): [be[example.test]] [_read_pipe_handler] (0x0400): [RID#5] EOF received, client finished * (2024-10-21 10:11:05): [be[example.test]] [selinux_child_done] (0x0020): [RID#5] selinux_child_parse_response failed: [22][Invalid argument] ********************** BACKTRACE DUMP ENDS HERE ********************************* Reproducible: Always Steps to Reproduce: 1. Build an image with sssd-ipa package installed 2. Rebase to this image with rpm-ostree rebase REFSPEC 3. Enroll the system to IPA domain 4. Attempt to login as IPA user Actual Results: Failure to login, with a result in the logs 'System error' Expected Results: Login to system with IPA user is successful -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2320133 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 10

[Bug 2325893] New: sssd gpo_child doesn't have sufficient rights to populate GPO policies
by bugzilla＠redhat.com 13 Nov '24

13 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2325893 Bug ID: 2325893 Summary: sssd gpo_child doesn't have sufficient rights to populate GPO policies Product: Fedora Version: 41 Hardware: x86_64 OS: Linux Status: NEW Component: sssd Keywords: CommonBugs, Desktop Severity: medium Assignee: sssd-maintainers(a)lists.fedoraproject.org Reporter: nekopilot(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: abokovoy(a)redhat.com, atikhono(a)redhat.com, lslebodn(a)redhat.com, mzidek(a)redhat.com, pbrezina(a)redhat.com, sbose(a)redhat.com, ssorce(a)redhat.com, sssd-maintainers(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora # 1. Issue After upgrade from F39 to F41 via UI path the login to the system with AD account is not possible. Local account works well. # 2. Workaround sssd service works under sssd user in Fedora 41. The folder with GPO policies has wrong rights with owner root: ls -lah /var/lib/sss/gpo_cache/example.com/Policies/ total 0 drwx------. 4 root root 98 Jan 10 2024 . drwx------. 3 sssd sssd 22 Jan 10 2024 .. drwx------. 3 root root 36 Nov 13 07:33 {31B2F332-016D-11D2-945F-00C04FBB84F9} drwx------. 3 root root 36 Nov 13 07:33 {7E50761D-1E4D-4D2B-BD86-E667EED3DF1E} It is possible to change the owner of the directories. After that the login with AD account works well. chown -R sssd:sssd /var/lib/sss/gpo_cache Reproducible: Always Steps to Reproduce: 1. Your F39 system must be joined to AD with sssd and you can login to the system with AD account. 2. Upgrade from F39 to F41. 3. Try to login with AD account. Actual Results: Login from Gnome UI is not possible with error: "Wrong user name or password". Expected Results: You can login to the system with AD account. Your F39 system must be joined to AD with sssd and you can login to the system with AD account. After upgrade you can't login from UI with AD account but: 1. kinit user.name(a)example.com - works well. 1. id user.name(a)example.com - works well. 1. realm list - looks good. In logs you can find error message: cat /var/log/sssd/gpo_child.log ``` [gpo_child[4066]] [prepare_gpo_cache] (0x0020): [RID#23] mkdir(/var/lib/sss/gpo_cache/example.com/Policies/{31B2F332-016D-11D2-945F-… failed: 13 ``` -- You are receiving this mail because: You are on the CC list for the bug. You are the assignee for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2325893 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 2

2024

2023

2022

2021

2020

Sssd-maintainers November 2024