- Issued:
- 2019-01-29
- Updated:
- 2019-01-29
RHBA-2019:0169 - sssd bug fix update
Synopsis
sssd bug fix update
Type/Severity
Bug Fix Advisory None
Topic
Updated sssd packages that fix several bugs are now available for Red Hat Enterprise Linux 7.
Description
The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources.
This update fixes the following bugs:
-
Previously, if a user had a non-standard home directory and did not have explicit mapping to an SELinux user, the SSSD service skipped setting this user's login context due to a bad optimization in the code. This update removes the optimization. As a result, SSSD now sets the SELinux login context even for users with a non-standard home directory and no explicit mapping to an SELinux user. (BZ#1645047)
-
Previously, the SSSD service searched sudo rules in a case-sensitive way even for case-insensitive domains. As a result, SSSD was not able to find all sudo rules in the Active Directory (AD). With this update, SSSD ignores case of sudo rule names for case-insensitive domains. as a result, SSSD is able to find all sudo rules in AD. (BZ#1649784)
-
Previously, a bad talloc memory hierarchy in the sssd_nss module caused growing memory consumption of sssd_nss. This update fixes the memory hierarchy and sssd_nss no longer leaks memory. (BZ#1656833)
-
Previously, the SSSD service looked incorrectly for data in a global catalog in multiple domains instead of one domain. As a consequence, SSSD sometimes could not retrieve Active Directory (AD) users through the IPA trust. This update fixes SSSD to use global catalog properly. As a result, SSSD always retrieves users from AD through the IPA trust. (BZ#1659083)
-
Previously, when id_provider and auth_provider were not the same, the SSSD service did not bind the domain name (DN) of the user, which wanted to authenticate with the ldap_default_bind_dn and the password provided by the user. As a consequence, Active Directory (AD) users could not authenticate with generic security services API (GSSAPI) when id_provider was set to ldap. With this update, when id_provider and auth_provider are not the same, SSSD now properly binds the DN of the user that wanted to authenticate with the ldap_default_bind_dn and the password provided by the user. As a result, the described problem no longer occurs. (BZ#1659507)
Users of sssd are advised to upgrade to these updated packages, which fix these bugs.
Solution
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions | 7.6 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 7.6 | x86_64 |
| Red Hat Enterprise Linux for Scientific Computing | 7 | x86_64 |
| Red Hat Enterprise Linux for Power, little endian | 7 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 7.6 | ppc64le |
| Red Hat Enterprise Linux for Power, big endian | 7 | ppc64 |
| Red Hat Enterprise Linux for Power, big endian - Extended Update Support | 7.6 | ppc64 |
| Red Hat Enterprise Linux for Power 9 | 7 | ppc64le |
| Red Hat Enterprise Linux for IBM z Systems | 7 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 7.6 | s390x |
| Red Hat Enterprise Linux for IBM System z (Structure A) | 7 | s390x |
| Red Hat Enterprise Linux for ARM 64 | 7 | aarch64 |
| Red Hat Enterprise Linux Workstation | 7 | x86_64 |
| Red Hat Enterprise Linux Server | 7 | x86_64 |
| Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions | 7.6 | ppc64le |
| Red Hat Enterprise Linux Server - TUS | 7.6 | x86_64 |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support | 7 | x86_64 |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian | 7 | ppc64le |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian | 7 | ppc64 |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) | 7 | s390x |
| Red Hat Enterprise Linux Server - AUS | 7.6 | x86_64 |
| Red Hat Enterprise Linux EUS Compute Node | 7.6 | x86_64 |
| Red Hat Enterprise Linux Desktop | 7 | x86_64 |
Updated Packages
- libsss_sudo-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_simpleifp-devel-1.16.2-13.el7_6.5.ppc64.rpm
- python-libsss_nss_idmap-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-common-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_nss_idmap-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_simpleifp-devel-1.16.2-13.el7_6.5.s390.rpm
- sssd-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-dbus-1.16.2-13.el7_6.5.ppc64le.rpm
- libsss_idmap-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-krb5-common-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-libwbclient-devel-1.16.2-13.el7_6.5.i686.rpm
- sssd-debuginfo-1.16.2-13.el7_6.5.s390x.rpm
- sssd-polkit-rules-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-tools-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-tools-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_certmap-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-libwbclient-devel-1.16.2-13.el7_6.5.s390x.rpm
- python-sss-murmur-1.16.2-13.el7_6.5.s390x.rpm
- sssd-common-1.16.2-13.el7_6.5.s390x.rpm
- sssd-proxy-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-tools-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-krb5-common-1.16.2-13.el7_6.5.s390x.rpm
- sssd-tools-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-1.16.2-13.el7_6.5.s390x.rpm
- libipa_hbac-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_nss_idmap-1.16.2-13.el7_6.5.s390.rpm
- sssd-krb5-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-client-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_idmap-devel-1.16.2-13.el7_6.5.s390.rpm
- libsss_nss_idmap-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_idmap-devel-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_idmap-1.16.2-13.el7_6.5.i686.rpm
- python-sss-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-krb5-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_autofs-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_certmap-1.16.2-13.el7_6.5.ppc64le.rpm
- libsss_certmap-1.16.2-13.el7_6.5.s390.rpm
- sssd-tools-1.16.2-13.el7_6.5.s390x.rpm
- libsss_idmap-1.16.2-13.el7_6.5.ppc64le.rpm
- libsss_simpleifp-devel-1.16.2-13.el7_6.5.i686.rpm
- libsss_simpleifp-1.16.2-13.el7_6.5.s390.rpm
- libsss_idmap-1.16.2-13.el7_6.5.ppc.rpm
- sssd-libwbclient-devel-1.16.2-13.el7_6.5.ppc64le.rpm
- libsss_idmap-devel-1.16.2-13.el7_6.5.i686.rpm
- libsss_simpleifp-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-debuginfo-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_simpleifp-devel-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_nss_idmap-1.16.2-13.el7_6.5.i686.rpm
- python-libsss_nss_idmap-1.16.2-13.el7_6.5.s390x.rpm
- python-libipa_hbac-1.16.2-13.el7_6.5.ppc64le.rpm
- libsss_idmap-1.16.2-13.el7_6.5.s390x.rpm
- libipa_hbac-1.16.2-13.el7_6.5.s390x.rpm
- libipa_hbac-devel-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_nss_idmap-1.16.2-13.el7_6.5.s390x.rpm
- libipa_hbac-1.16.2-13.el7_6.5.aarch64.rpm
- python-sss-murmur-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-client-1.16.2-13.el7_6.5.s390x.rpm
- sssd-kcm-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_idmap-devel-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_simpleifp-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-winbind-idmap-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_certmap-devel-1.16.2-13.el7_6.5.s390x.rpm
- libsss_nss_idmap-devel-1.16.2-13.el7_6.5.s390.rpm
- python-libipa_hbac-1.16.2-13.el7_6.5.s390x.rpm
- sssd-ad-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_idmap-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_sudo-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-client-1.16.2-13.el7_6.5.s390.rpm
- sssd-polkit-rules-1.16.2-13.el7_6.5.s390x.rpm
- sssd-winbind-idmap-1.16.2-13.el7_6.5.ppc64le.rpm
- libsss_certmap-devel-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-client-1.16.2-13.el7_6.5.ppc64le.rpm
- libsss_nss_idmap-devel-1.16.2-13.el7_6.5.ppc.rpm
- libsss_simpleifp-devel-1.16.2-13.el7_6.5.ppc64le.rpm
- libsss_certmap-devel-1.16.2-13.el7_6.5.ppc.rpm
- sssd-common-pac-1.16.2-13.el7_6.5.s390x.rpm
- sssd-common-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-debuginfo-1.16.2-13.el7_6.5.ppc.rpm
- libipa_hbac-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_simpleifp-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-libwbclient-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_nss_idmap-devel-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_autofs-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-libwbclient-1.16.2-13.el7_6.5.s390x.rpm
- python-libipa_hbac-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-common-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-ipa-1.16.2-13.el7_6.5.s390x.rpm
- sssd-ipa-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_certmap-devel-1.16.2-13.el7_6.5.s390.rpm
- sssd-libwbclient-devel-1.16.2-13.el7_6.5.ppc.rpm
- libsss_simpleifp-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-polkit-rules-1.16.2-13.el7_6.5.x86_64.rpm
- python-sss-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-ipa-1.16.2-13.el7_6.5.ppc64le.rpm
- python-libipa_hbac-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-common-pac-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_idmap-1.16.2-13.el7_6.5.s390.rpm
- python-libipa_hbac-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_simpleifp-devel-1.16.2-13.el7_6.5.ppc.rpm
- libsss_certmap-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-dbus-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_simpleifp-1.16.2-13.el7_6.5.ppc.rpm
- sssd-debuginfo-1.16.2-13.el7_6.5.i686.rpm
- sssd-libwbclient-devel-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-libwbclient-devel-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-krb5-1.16.2-13.el7_6.5.ppc64.rpm
- libipa_hbac-1.16.2-13.el7_6.5.i686.rpm
- libsss_nss_idmap-devel-1.16.2-13.el7_6.5.i686.rpm
- sssd-krb5-common-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-ipa-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-common-pac-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-dbus-1.16.2-13.el7_6.5.s390x.rpm
- sssd-proxy-1.16.2-13.el7_6.5.x86_64.rpm
- python-sss-murmur-1.16.2-13.el7_6.5.ppc64le.rpm
- libipa_hbac-1.16.2-13.el7_6.5.ppc.rpm
- sssd-kcm-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_certmap-devel-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_idmap-devel-1.16.2-13.el7_6.5.ppc64le.rpm
- python-sss-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_certmap-1.16.2-13.el7_6.5.ppc64.rpm
- python-sss-murmur-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-ad-1.16.2-13.el7_6.5.s390x.rpm
- sssd-client-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_autofs-1.16.2-13.el7_6.5.s390x.rpm
- libsss_sudo-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-common-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-debuginfo-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-ldap-1.16.2-13.el7_6.5.s390x.rpm
- sssd-ipa-1.16.2-13.el7_6.5.aarch64.rpm
- libipa_hbac-devel-1.16.2-13.el7_6.5.ppc64.rpm
- python-sss-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-proxy-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-winbind-idmap-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-libwbclient-devel-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_nss_idmap-devel-1.16.2-13.el7_6.5.s390x.rpm
- sssd-winbind-idmap-1.16.2-13.el7_6.5.s390x.rpm
- libipa_hbac-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-client-1.16.2-13.el7_6.5.ppc.rpm
- sssd-polkit-rules-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-winbind-idmap-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-ldap-1.16.2-13.el7_6.5.ppc64le.rpm
- libsss_nss_idmap-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-kcm-1.16.2-13.el7_6.5.s390x.rpm
- libsss_certmap-1.16.2-13.el7_6.5.s390x.rpm
- sssd-proxy-1.16.2-13.el7_6.5.s390x.rpm
- libsss_certmap-1.16.2-13.el7_6.5.ppc.rpm
- sssd-proxy-1.16.2-13.el7_6.5.ppc64le.rpm
- libsss_nss_idmap-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-ldap-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-libwbclient-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_simpleifp-devel-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-libwbclient-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-1.16.2-13.el7_6.5.aarch64.rpm
- libipa_hbac-devel-1.16.2-13.el7_6.5.ppc.rpm
- libsss_simpleifp-devel-1.16.2-13.el7_6.5.s390x.rpm
- libipa_hbac-devel-1.16.2-13.el7_6.5.ppc64le.rpm
- python-sssdconfig-1.16.2-13.el7_6.5.noarch.rpm
- libsss_idmap-devel-1.16.2-13.el7_6.5.x86_64.rpm
- libipa_hbac-1.16.2-13.el7_6.5.s390.rpm
- sssd-ad-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-ldap-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-krb5-common-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_idmap-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_nss_idmap-devel-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-ldap-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_autofs-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_sudo-1.16.2-13.el7_6.5.s390x.rpm
- sssd-1.16.2-13.el7_6.5.src.rpm
- python-sss-1.16.2-13.el7_6.5.s390x.rpm
- libsss_certmap-devel-1.16.2-13.el7_6.5.i686.rpm
- libsss_nss_idmap-1.16.2-13.el7_6.5.ppc.rpm
- libsss_simpleifp-1.16.2-13.el7_6.5.s390x.rpm
- libsss_sudo-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-debuginfo-1.16.2-13.el7_6.5.s390.rpm
- sssd-dbus-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-debuginfo-1.16.2-13.el7_6.5.ppc64.rpm
- python-libsss_nss_idmap-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-client-1.16.2-13.el7_6.5.aarch64.rpm
- python-libsss_nss_idmap-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-kcm-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-krb5-1.16.2-13.el7_6.5.ppc64le.rpm
- python-sss-murmur-1.16.2-13.el7_6.5.aarch64.rpm
- libipa_hbac-devel-1.16.2-13.el7_6.5.i686.rpm
- libsss_certmap-1.16.2-13.el7_6.5.i686.rpm
- sssd-dbus-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-polkit-rules-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-common-pac-1.16.2-13.el7_6.5.ppc64.rpm
- libipa_hbac-devel-1.16.2-13.el7_6.5.aarch64.rpm
- sssd-krb5-1.16.2-13.el7_6.5.s390x.rpm
- sssd-client-1.16.2-13.el7_6.5.i686.rpm
- sssd-ad-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_nss_idmap-devel-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_certmap-devel-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_certmap-devel-1.16.2-13.el7_6.5.x86_64.rpm
- libsss_nss_idmap-devel-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-debuginfo-1.16.2-13.el7_6.5.x86_64.rpm
- sssd-krb5-common-1.16.2-13.el7_6.5.ppc64.rpm
- libsss_autofs-1.16.2-13.el7_6.5.ppc64le.rpm
- libipa_hbac-devel-1.16.2-13.el7_6.5.s390x.rpm
- libipa_hbac-devel-1.16.2-13.el7_6.5.s390.rpm
- sssd-ad-1.16.2-13.el7_6.5.ppc64.rpm
- sssd-kcm-1.16.2-13.el7_6.5.aarch64.rpm
- libsss_idmap-devel-1.16.2-13.el7_6.5.s390x.rpm
- libsss_idmap-devel-1.16.2-13.el7_6.5.ppc.rpm
- sssd-libwbclient-1.16.2-13.el7_6.5.ppc64le.rpm
- python-libsss_nss_idmap-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-common-pac-1.16.2-13.el7_6.5.ppc64le.rpm
- sssd-libwbclient-devel-1.16.2-13.el7_6.5.s390.rpm
- libsss_simpleifp-1.16.2-13.el7_6.5.i686.rpm
Fixes
CVEs
(none)
References
(none)
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.