https://bugzilla.redhat.com/show_bug.cgi?id=2320133
Bug ID: 2320133 Summary: When installing sssd-ipa package in rpm-ostree image, selinux_child loses capabilities defined in the RPM package Product: Fedora Version: 41 OS: Linux Status: NEW Component: sssd Severity: medium Assignee: sssd-maintainers@lists.fedoraproject.org Reporter: abokovoy@redhat.com QA Contact: extras-qa@fedoraproject.org CC: abokovoy@redhat.com, atikhono@redhat.com, lslebodn@redhat.com, mzidek@redhat.com, pbrezina@redhat.com, sbose@redhat.com, ssorce@redhat.com, sssd-maintainers@lists.fedoraproject.org Target Milestone: --- Classification: Fedora
If rpm-ostree-based image includes sssd-ipa, the resulting /usr/libexec/sssd/selinux_child does not have expected file capabilities present:
# getcap -v /usr/libexec/sssd/*child /usr/libexec/sssd/gpo_child /usr/libexec/sssd/krb5_child cap_chown,cap_dac_override,cap_setgid,cap_setuid=ep /usr/libexec/sssd/ldap_child cap_chown,cap_dac_override,cap_setgid,cap_setuid=ep /usr/libexec/sssd/oidc_child /usr/libexec/sssd/p11_child /usr/libexec/sssd/passkey_child /usr/libexec/sssd/proxy_child /usr/libexec/sssd/selinux_child
The capabilities are present in the RPM database: $ rpm -q --filecaps sssd-ipa | grep selinux_child /usr/libexec/sssd/selinux_child cap_chown,cap_dac_override,cap_setgid,cap_setuid=ep
Lack of capabilities on the selinux_child causes PAM account phase to fail:
(2024-10-21 10:11:05): [be[example.test]] [selinux_child_done] (0x0020): [RID#5] selinux_child_parse_response failed: [22][Invalid argument] ********************** PREVIOUS MESSAGE WAS TRIGGERED BY THE FOLLOWING BACKTRACE: * (2024-10-21 10:11:05): [be[example.test]] [sdap_handle_release] (0x2000): Trace: sh[0x56040e7054d0], connected[1], ops[(nil)], ldap[0x56040e74efb0], destructor_lock[0], release_memory[0] * (2024-10-21 10:11:05): [be[example.test]] [remove_connection_callback] (0x4000): Successfully removed connection callback. * (2024-10-21 10:11:05): [be[example.test]] [_read_pipe_handler] (0x0400): [RID#5] EOF received, client finished * (2024-10-21 10:11:05): [be[example.test]] [selinux_child_done] (0x0020): [RID#5] selinux_child_parse_response failed: [22][Invalid argument] ********************** BACKTRACE DUMP ENDS HERE *********************************
Reproducible: Always
Steps to Reproduce: 1. Build an image with sssd-ipa package installed 2. Rebase to this image with rpm-ostree rebase REFSPEC 3. Enroll the system to IPA domain 4. Attempt to login as IPA user
Actual Results: Failure to login, with a result in the logs 'System error'
Expected Results: Login to system with IPA user is successful