https://bugzilla.redhat.com/show_bug.cgi?id=2325893

Bug ID: 2325893 Summary: sssd gpo_child doesn't have sufficient rights to populate GPO policies Product: Fedora Version: 41 Hardware: x86_64 OS: Linux Status: NEW Component: sssd Keywords: CommonBugs, Desktop Severity: medium Assignee: sssd-maintainers@lists.fedoraproject.org Reporter: nekopilot@gmail.com QA Contact: extras-qa@fedoraproject.org CC: abokovoy@redhat.com, atikhono@redhat.com, lslebodn@redhat.com, mzidek@redhat.com, pbrezina@redhat.com, sbose@redhat.com, ssorce@redhat.com, sssd-maintainers@lists.fedoraproject.org Target Milestone: --- Classification: Fedora

# 1. Issue After upgrade from F39 to F41 via UI path the login to the system with AD account is not possible. Local account works well.

# 2. Workaround sssd service works under sssd user in Fedora 41. The folder with GPO policies has wrong rights with owner root: ls -lah /var/lib/sss/gpo_cache/example.com/Policies/ total 0 drwx------. 4 root root 98 Jan 10 2024 . drwx------. 3 sssd sssd 22 Jan 10 2024 .. drwx------. 3 root root 36 Nov 13 07:33 {31B2F332-016D-11D2-945F-00C04FBB84F9} drwx------. 3 root root 36 Nov 13 07:33 {7E50761D-1E4D-4D2B-BD86-E667EED3DF1E}

It is possible to change the owner of the directories. After that the login with AD account works well. chown -R sssd:sssd /var/lib/sss/gpo_cache

Reproducible: Always

Steps to Reproduce: 1. Your F39 system must be joined to AD with sssd and you can login to the system with AD account. 2. Upgrade from F39 to F41. 3. Try to login with AD account.

Actual Results: Login from Gnome UI is not possible with error: "Wrong user name or password".

Expected Results: You can login to the system with AD account.

Your F39 system must be joined to AD with sssd and you can login to the system with AD account.

After upgrade you can't login from UI with AD account but: 1. kinit user.name@example.com - works well. 1. id user.name@example.com - works well. 1. realm list - looks good.

In logs you can find error message: cat /var/log/sssd/gpo_child.log ``` [gpo_child[4066]] [prepare_gpo_cache] (0x0020): [RID#23] mkdir(/var/lib/sss/gpo_cache/example.com/Policies/{31B2F332-016D-11D2-945F-00C04FBB84F9}) failed: 13 ```