sudo-project/sudo

AIX: problem with local groups and LDAP users in /etc/sudoers

aklyachkin opened this issue · 8 comments

millert commented

Based on https://www.ibm.com/docs/en/aix/7.2?topic=s-setauthdb-setauthdb-r-subroutine, I would expect local groups to be found even when the authdb is set to LDAP if domainlessgroups=yes. What is the value of SYSTEM in your /etc/security/user file?

millert commented

Also, in your test program can you try using IDtogroup() to convert the group ID to a group name and if that succeeds, try to look it up with getgrnam()?

aklyachkin commented

Hello Todd,

thank you for your suggestion. This is the new code of my test:

#include <usersec.h>
#include <errno.h>
#include <stdio.h>
#include <grp.h>

#define LDAPGRP 40032
#define LOCALGRP 600

void test_getgrgid(gid_t gid) {
  struct group *gr;

  gr = getgrgid(gid);
  if (gr == NULL) {
    printf("getgrgid() failed to find the group\n");
  } else {
    printf("getgrid(): Group name = %s, GID = %d\n", gr->gr_name, gr->gr_gid);
  }
}

void test_id2grp(gid_t gid) {
  char *gname;
  struct group *gr;

  gname = IDtogroup(gid);
  if (gname == NULL) {
    printf("IDtogroup() failed to find the group\n");
  } else {
    gr = getgrnam(gname);
    if (gr == NULL) {
      printf("IDtogroup() succeeds, but not getgrnam(). Group name = %s\n", gname);
    } else {
      printf("IDtogroup()&getgrnam(): Group name = %s, GID = %d\n", gr->gr_name, gr->gr_gid);
    }
  }
}

int main(int argc, char *argv[]) {
  int rc;
  struct group *gr;

  printf("Trying to find groups without setauthdb()\n");
  printf("Searching for LDAP group with GID %d\n", LDAPGRP);
  test_getgrgid(LDAPGRP);
  test_id2grp(LDAPGRP);
  printf("Searching for local group with GID %d\n", LOCALGRP);
  test_getgrgid(LOCALGRP);
  test_id2grp(LOCALGRP);
  printf("Trying to find groups with setauthdb()\n");
  rc = setauthdb("LDAP", NULL);
  if (rc != 0) {
    printf("setauthdb RC = %d\n", rc);
    return 1;
  }
  printf("Searching for LDAP group with GID %d\n", LDAPGRP);
  test_getgrgid(LDAPGRP);
  test_id2grp(LDAPGRP);
  printf("Searching for local group with GID %d\n", LOCALGRP);
  test_getgrgid(LOCALGRP);
  test_id2grp(LOCALGRP);
  return 0;
}

Here is the output of the test:

Trying to find groups without setauthdb()
Searching for LDAP group with GID 40032
getgrid(): Group name = DB2LUWADM_T, GID = 40032
IDtogroup()&getgrnam(): Group name = DB2LUWADM_T, GID = 40032
Searching for local group with GID 600
getgrid(): Group name = dbexpert, GID = 600
IDtogroup()&getgrnam(): Group name = dbexpert, GID = 600
Trying to find groups with setauthdb()
Searching for LDAP group with GID 40032
getgrid(): Group name = DB2LUWADM_T, GID = 40032
IDtogroup()&getgrnam(): Group name = DB2LUWADM_T, GID = 40032
Searching for local group with GID 600
getgrgid() failed to find the group
IDtogroup() succeeds, but not getgrnam(). Group name = dbexpert

Looks like IDtogroup() works better in this case, but not getgrnam()/getgrgid().

The default registry is LDAP and SYSTEM is "LDAP OR KRB5files" on the system.

millert commented

Would you mind testing whether getgroupattr() is able to find the group?

aklyachkin commented

Todd,

I added test for getgroupattr(), but it fails the same way as getgrnam() - with ENOENT.

millert commented

Thanks for trying. The AIX documentation says that if setauthdb() is used to set domain to LDAP or files and the domainlessgroups attribute is set to true in the /etc/secvars.cfg then group lookups should be performed on both LDAP and files. That's clearly not happening though which makes me think this is an AIX bug.

aklyachkin commented

Thank you Todd. I opened a case at IBM, let's see what they say.

aklyachkin commented

Short summary:

Thank you for your help!