[SSSD] SSSD Configuration issue

Jakub Hrozek jhrozek at redhat.com
Mon Nov 21 13:13:33 UTC 2011


On Mon, Nov 21, 2011 at 05:50:40PM +0530, Nitesh Mehare wrote:
>    Was anybody able to look at the trace...
> 
>    Thanks ....
> 

Sorry Nitesh, I forgot to reply.

The trace clearly shows that pam_sss sends data to and receives data
from the private sssd PAM socket:

-----
stat("/var/lib/sss/pipes/private/pam", {st_mode=S_IFSOCK|0600,
st_size=0, ...}) = 0
socket(PF_FILE, SOCK_STREAM, 0)         = 5
fcntl(5, F_GETFL)                       = 0x2 (flags O_RDWR)
fcntl(5, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
fcntl(5, F_GETFD)                       = 0
fcntl(5, F_SETFD, FD_CLOEXEC)           = 0
connect(5, {sa_family=AF_FILE,
path="/var/lib/sss/pipes/private/pam"...}, 110) = 0
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "\3\0\0\0", 4)                 = 4
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\3\0\0\0", 4)                  = 4
getsockopt(5, SOL_SOCKET, SO_PEERCRED, "LY\0\0\0\0\0\0\0\0\0\0", [12]) =
0
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "]\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLOUT}], 1, 300000) = 1 ([{fd=5,
revents=POLLOUT}])
write(5, "IPAM\1\0\0\0\t\0\0\0nitback1\0\2\0\0\0\5\0\0\0su-"..., 77) =
77
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "%\0\0\0\364\0\0\0\0\0\0\0\0\0\0\0", 16) = 16
poll([{fd=5, events=POLLIN}], 1, 300000) = 1 ([{fd=5, revents=POLLIN}])
read(5, "\0\0\0\0\1\0\0\0\2\0\0\0\5\0\0\0LDAP\0", 21) = 21
----

I'm not sure why pam_sss wouldn't show in the secure logs...

Does SSSD print anything /var/log/sssd/sssd_pam.log when you put
'debug_level = 9' into the [pam] section of the SSSD config?


>        Tha above trace I have take with selinux is disabled.The setting of
>        selinux is as follows
> 
>        bash-3.2# cat /etc/selinux/config
>        # This file controls the state of SELinux on the system.
>        # SELINUX= can take one of these three values:
>        #A A A A A A  enforcing - SELinux security policy is enforced.
>        #A A A A A A  permissive - SELinux prints warnings instead of
>        enforcing.
>        #A A A A A A  disabled - SELinux is fully disabled.
>        SELINUX=disabled
>        # SELINUXTYPE= type of policy in use. Possible values are:
>        #A A A A A A  targeted - Only targeted network daemons are protected.
>        #A A A A A A  strict - Full SELinux protection.
>        SELINUXTYPE=targeted
>        bash-3.2#
> 
>        I'm not sure how to check for AVC denials when selinux is set to
>        enforcing.Could you tell me how to do that.
> 
>        Thanks...
> 

When SELinux is disabled, it can't generate any AVC denial messages nor
it can block access to the pipes (which was my concern).



More information about the sssd-devel mailing list