pam_sss messes up existing /var/log/sssd/p11_child.log permissions

I was able to reproduce the issue, but not in a deterministic manner. In fact, most of the time I can't trigger the bug at all. I'm still not sure if it's something I'm messing up, or it this bug is indeed racy.

Here are the steps I'm taking to (try to) reproduce:

$ lxc launch ubuntu-daily:kinetic sssd-bug1989356
$ lxc shell sssd-bug1989356
# apt update
# apt install -y sssd
# cat > /etc/sssd/sssd.conf << __EOF__
[sssd]
domains = local

[domain/local]
id_provider = files
__EOF__
# chmod 0600 /etc/sssd/sssd.conf
# touch /var/log/sssd/p11_child.log
# ls -la /var/log/sssd/p11_child.log
# passwd ubuntu
<choose an easy password here>
# systemctl restart sssd.service
# login ubuntu
<type the easy password>
$ exit
# ls -la /var/log/sssd/p11_child.log

It seems like if I use a VM instead of a container (i.e., pass "--vm" to "lxc launch") I can reproduce the bug consistently.

I filed an upstream bug, but I'm still investigating and trying to determine what's going on.

Super excellent work, thanks a lot!

On Tuesday, October 04 2022, Marius Vollmer wrote:

> Super excellent work, thanks a lot!

Thanks. I'll work on SRUing the fix into Jammy/Kinetic later today.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

Hello Marius, or anyone else affected,

Accepted sssd into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/sssd/2.6.3-1ubuntu3.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

This bug was fixed in the package sssd - 2.7.3-2ubuntu2

---------------
sssd (2.7.3-2ubuntu2) kinetic; urgency=medium

  * d/p/initialize-uid-gid-main-functions.patch: Initialize UID/GID
    variables in "main" functions, preventing inadvertent changes in
    p11_child.log file permissions. (LP: #1989356)

 -- Sergio Durigan Junior <email address hidden> Tue, 04 Oct 2022 19:00:49 -0400

Performing the verification for Jammy.

First, reproducing the issue:

# systemctl restart sssd.service
# login ubuntu
...
# ls -la /var/log/sssd/p11_child.log
-rw-r--r-- 1 root 65 0 Oct 20 03:12 /var/log/sssd/p11_child.log

# apt policy sssd
sssd:
  Installed: 2.6.3-1ubuntu3.1
  Candidate: 2.6.3-1ubuntu3.1
  Version table:
 *** 2.6.3-1ubuntu3.1 500
        500 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     2.6.3-1ubuntu3 500
        500 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages

Now, confirming that the new package fixes the bug:

# rm /var/log/sssd/p11_child.log
# touch /var/log/sssd/p11_child.log
# systemctl restart sssd.service
# login ubuntu
...
# ls -la /var/log/sssd/p11_child.log
-rw-r--r-- 1 root root 0 Oct 20 03:15 /var/log/sssd/p11_child.log

# apt policy sssd
sssd:
  Installed: 2.6.3-1ubuntu3.2
  Candidate: 2.6.3-1ubuntu3.2
  Version table:
 *** 2.6.3-1ubuntu3.2 500
        500 http://archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages
        100 /var/lib/dpkg/status
     2.6.3-1ubuntu3.1 500
        500 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
     2.6.3-1ubuntu3 500
        500 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages

This concludes the verification.

This bug was fixed in the package sssd - 2.6.3-1ubuntu3.2

---------------
sssd (2.6.3-1ubuntu3.2) jammy; urgency=medium

  * d/p/initialize-uid-gid-main-functions.patch: Initialize UID/GID
    variables in "main" functions, preventing inadvertent changes in
    p11_child.log file permissions. (LP: #1989356)

 -- Sergio Durigan Junior <email address hidden> Tue, 04 Oct 2022 19:04:33 -0400

The verification of the Stable Release Update for sssd has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.