** Tags removed: glucid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to libgcrypt11 in Ubuntu. https://bugs.launchpad.net/bugs/423252
Title: NSS using LDAP+SSL breaks setuid applications like su, sudo, apache2 suexec, and atd Status in libgcrypt: Fix Released Status in Release Notes for Ubuntu: Fix Released Status in libgcrypt11 package in Ubuntu: Fix Released Status in eglibc source package in Lucid: Invalid Status in libgcrypt11 source package in Lucid: Fix Released Status in libnss-ldap source package in Lucid: Invalid Status in sudo source package in Lucid: Invalid Status in eglibc source package in Maverick: Invalid Status in libgcrypt11 source package in Maverick: Won't Fix Status in libnss-ldap source package in Maverick: Invalid Status in sudo source package in Maverick: Invalid Status in eglibc source package in Natty: Invalid Status in libgcrypt11 source package in Natty: Invalid Status in libnss-ldap source package in Natty: Invalid Status in sudo source package in Natty: Invalid Status in eglibc source package in Oneiric: Invalid Status in libgcrypt11 source package in Oneiric: Invalid Status in libnss-ldap source package in Oneiric: Invalid Status in sudo source package in Oneiric: Invalid Status in eglibc source package in Precise: Invalid Status in libgcrypt11 source package in Precise: Fix Released Status in libnss-ldap source package in Precise: Invalid Status in sudo source package in Precise: Invalid Status in eglibc source package in Karmic: Invalid Status in libgcrypt11 source package in Karmic: Won't Fix Status in libnss-ldap source package in Karmic: Invalid Status in sudo source package in Karmic: Invalid Status in gnutls26 package in Debian: Confirmed Status in libgcrypt11 package in Debian: Confirmed Status in libnss-ldap package in Debian: Confirmed Status in sudo package in Debian: Confirmed Bug description: SRU Request: [Impact] As heavily outlined in the amount of comments in this bug the impact is detrimental to both community and enterprise users alike. [Development Fix] Howard Chu released a patch in #73 which was later confirmed in #106 & #108 as a resolution. [Stable Fix] Patch from #73 can be applied cleanly to Lucid and new distributions. [Test Case] On Karmic (alpha 4 plus updates), changing the nsswitch.conf 'passwd' field to anything with 'ldap' as the first item breaks the ability to become root using 'su' and 'sudo' as anyone but root. Default nsswitch.conf: passwd: compat group: compat shadow: compat matt@box:~$ sudo uname -a [sudo] password for matt: Linux box 2.6.31-9-server #29-Ubuntu SMP Sun Aug 30 18:37:42 UTC 2009 x86_64 GNU/Linux matt@box:~$ su - Password: root@box:~# Modified nsswitch.conf with 'ldap' before 'compat': passwd: ldap compat group: ldap compat shadow: ldap compat matt@box:~$ sudo uname -a sudo: setreuid(ROOT_UID, user_uid): Operation not permitted matt@box:~$ su - Password: setgid: Operation not permitted Modified nsswitch.conf with 'ldap' after 'compat': passwd: compat ldap group: compat ldap shadow: compat ldap matt@box:~$ sudo uname -a [sudo] password for matt: Linux box 2.6.31-9-server #29-Ubuntu SMP Sun Aug 30 18:37:42 UTC 2009 x86_64 GNU/Linux matt@box:~$ su - Password: root@box:~# The same arrangements in nsswitch.conf work as expected in Jaunty and earlier releases. [Regression Potential] This should be minimal as the code change only addresses the duplicating global_init during thread callbacks. Lucid Release Note: == NSS via LDAP+SSL breaks setuid applications like sudo == Upgrading systems configured to use ldap over ssl as the first service in the nss stack (in nsswitch.conf) leads to a broken nss resolution for setuid applications after the upgrade to Lucid (for example sudo would stop working). There isn't any simple workaround for now. One option is to switch to libnss-ldapd in place of libnss-ldap before the upgrade. Another one consists in using nscd before the upgrade. To manage notifications about this bug go to: https://bugs.launchpad.net/libgcrypt/+bug/423252/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
