rpms/sssd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import Oracle_OSS sssd-2.12.0-3.0.1.el10_2.1

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-07-21 08:49:38 -04:00
parent 39e3882880
commit 2a2b4d0d64
4 changed files with 288 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

173
0004-reject-path-traversal-in-gpcfilesyspath.patch Normal file
View File

@ -0,0 +1,173 @@
From 3c1a31ab668b1ed7b97eb72d915a4187e549d86c Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Thu, 2 Jul 2026 17:29:51 +0200
Subject: [PATCH] gpo: reject path traversal in gPCFileSysPath
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The gPCFileSysPath LDAP attribute from AD Group Policy Objects is parsed
by ad_gpo_extract_smb_components() which converts backslashes to forward
slashes but does not reject ".." path traversal sequences. The resulting
smb_path is used directly in gpo_cache_store_file() to construct a local
filesystem path under GPO_CACHE_PATH, allowing an attacker with GPO
write access to write files outside the cache directory.
Due to differential path resolution between libsmbclient (which clamps
".." at the SMB share root) and the kernel (which resolves ".." fully),
the SMB download succeeds while the local file write escapes the cache.
On systems with SELinux enforcing, this enables Kerberos configuration
injection via /var/lib/sss/pubconf/krb5.include.d/ (sssd_public_t,
writable by sssd_t). On systems without SELinux, this enables arbitrary
file writes including cron job injection for root code execution.
This patch adds two layers of defense:
1. Reject ".." as a path component in smb_path at parse time in
ad_gpo_extract_smb_components(). Uses component-aware validation
that checks for "/..", "../", and exact ".." — not substring matching
which would false-positive on legitimate names containing "..".
2. Validate the resolved cache path stays within GPO_CACHE_PATH in
gpo_cache_store_file() using realpath(), with a trailing-slash
prefix check to prevent prefix-collision attacks (e.g.,
/var/lib/sss/gpo_cache_evil/ matching /var/lib/sss/gpo_cache).
Based on the patch by: Ian Murphy <imurphy@redhat.com>
Amended by: Alexey Tikhonov <atikhono@redhat.com>
:fixes: CVE-2026-14476
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
(cherry picked from commit ba207eab76ff5253662a763b9b6e9ea42f03d31b)
---
src/providers/ad/ad_gpo.c | 47 +++++++++++++++++++++++++++++++
src/providers/ad/ad_gpo_child.c | 49 +++++++++++++++++++++++++++++++++
2 files changed, 96 insertions(+)
diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c
index 952fa49a0e5..4dce4266580 100644
--- a/src/providers/ad/ad_gpo.c
+++ b/src/providers/ad/ad_gpo.c
@@ -3832,6 +3832,43 @@ ad_gpo_populate_candidate_gpos(TALLOC_CTX *mem_ctx,
return ret;
}
+/*
+ * Check whether a path contains ".." as a path component.
+ * Returns true if traversal is detected, false if the path is safe.
+ *
+ * Checks for:
+ * - "/.." anywhere in the path (component starting with ..)
+ * - "../" at the start of the path
+ * - exact match ".." (path is just "..")
+ * - "/.." at the end of the path
+ *
+ * Does NOT match ".." as a substring of a longer component
+ * (e.g., "my..file" is allowed).
+ */
+static bool gpo_path_has_traversal(const char *path)
+{
+ const char *p;
+
+ if (path == NULL) {
+ return false;
+ }
+
+ /* Exact match */
+ if (strcmp(path, "..") == 0) return true;
+
+ /* Starts with ../ */
+ if (strncmp(path, "../", 3) == 0) return true;
+
+ /* Contains /../ or ends with /.. */
+ p = path;
+ while ((p = strstr(p, "/..")) != NULL) {
+ if (p[3] == '/' || p[3] == '\0') return true;
+ p += 3;
+ }
+
+ return false;
+}
+
/*
* This function parses the input_path into its components, replaces each
* back slash ('\') with a forward slash ('/'), and populates the output params.
@@ -3908,6 +3945,16 @@ ad_gpo_extract_smb_components(TALLOC_CTX *mem_ctx,
goto done;
}
+ /* Reject path traversal. See function comment for what is matched. */
+ if (gpo_path_has_traversal(smb_path)) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "gPCFileSysPath contains path traversal component '..': "
+ "[%s]. Rejecting to prevent cache directory escape.\n",
+ smb_path);
+ ret = EINVAL;
+ goto done;
+ }
+
*_smb_server = talloc_asprintf(mem_ctx, "%s%s",
SMB_STANDARD_URI,
server_hostname);
diff --git a/src/providers/ad/ad_gpo_child.c b/src/providers/ad/ad_gpo_child.c
index 592509acf22..e5d7f2128af 100644
--- a/src/providers/ad/ad_gpo_child.c
+++ b/src/providers/ad/ad_gpo_child.c
@@ -322,6 +322,55 @@ static errno_t gpo_cache_store_file(const char *smb_path,
goto done;
}
+ /* Defense-in-depth: verify the resolved path stays within the cache
+ * directory (when updating existing files). This catches any bypass
+ * of the ".." check in the parser, including encoding tricks, symlink
+ * attacks, or future regressions.
+ *
+ * The trailing-slash comparison prevents prefix-collision attacks:
+ * without it, a path resolving to "/var/lib/sss/gpo_cache_evil/"
+ * would incorrectly match the prefix "/var/lib/sss/gpo_cache".
+ */
+ {
+ char *resolved = realpath(filename, NULL);
+ if (resolved != NULL) {
+ /* Resolve GPO_CACHE_PATH too so the comparison works
+ * even when the cache path contains symlinks. */
+ char *resolved_cache = realpath(GPO_CACHE_PATH, NULL);
+ if (resolved_cache == NULL) {
+ ret = errno;
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "realpath(\"%s\") failed: [%d][%s]\n",
+ GPO_CACHE_PATH, ret, strerror(ret));
+ free(resolved);
+ goto done;
+ }
+
+ /* Check that resolved path starts with resolved cache + "/" */
+ size_t cache_len = strlen(resolved_cache);
+ bool inside = ((strlen(resolved) >= cache_len) &&
+ (strncmp(resolved, resolved_cache, cache_len) == 0) &&
+ (resolved[cache_len] == '/' || resolved[cache_len] == '\0'));
+ if (!inside) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "GPO cache path escapes cache directory: [%s] "
+ "resolves to [%s] which is outside [%s]. "
+ "Rejecting.\n",
+ filename, resolved, resolved_cache);
+ free(resolved_cache);
+ free(resolved);
+ ret = EINVAL;
+ goto done;
+ }
+ free(resolved_cache);
+ free(resolved);
+ }
+ /* If realpath returns NULL, the path doesn't exist yet.
+ * prepare_gpo_cache() will create it — the mkdir calls
+ * are validated by SELinux MAC policy.
+ */
+ }
+
tmp_name = talloc_asprintf(tmp_ctx, "%sXXXXXX", filename);
if (tmp_name == NULL) {
DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed.\n");

78
0005-warn-when-ldap_sudo_search_base-fallback.patch Normal file
View File

@ -0,0 +1,78 @@
From aa74f8b06b974796dfc4760f2363ab78fbb8cc56 Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Fri, 3 Jul 2026 13:25:08 +0200
Subject: [PATCH] sudo: warn when ldap_sudo_search_base falls back to root DN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When ldap_sudo_search_base is not explicitly configured, SSSD falls back
to the domain's naming context (root DN) and searches the entire LDAP
directory tree for sudoRole objects. Any LDAP principal with write access
to any subtree can inject a sudoRole granting arbitrary sudo privileges
on every enrolled host.
This patch adds a warning log when the fallback occurs, alerting
administrators that their configuration searches the entire directory
tree for sudo rules. A future hardening step would be to default to
ou=sudoers,<base_dn> instead of the root DN.
The warning approach preserves backwards compatibility while ensuring
administrators are aware of the security implications.
Based on the patch by: Ian Murphy <imurphy@redhat.com>
Amended by: Alexey Tikhonov <atikhono@redhat.com>
:fixes: CVE-2026-14474
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reviewed-by: Tomáš Halman <thalman@redhat.com>
(cherry picked from commit ff8c1b19bcdbf79b733b052a7d926bd920b1205d)
---
src/providers/ldap/sdap.c | 19 +++++++++++++++++++
src/tests/system/tests/test_ldap.py | 2 +-
2 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/src/providers/ldap/sdap.c b/src/providers/ldap/sdap.c
index 38a48349633..61c3670c14e 100644
--- a/src/providers/ldap/sdap.c
+++ b/src/providers/ldap/sdap.c
@@ -1316,6 +1316,25 @@ errno_t sdap_set_config_options_with_rootdse(struct sysdb_attrs *rootdse,
/* Sudo */
if (!sdom->sudo_search_bases) {
+ /* At some point make this option mandatory,
+ * i.e. disable sudo rules lookup if 'sudo_search_bases' not set.
+ */
+ DEBUG(SSSDBG_IMPORTANT_INFO,
+ "`ldap_sudo_search_base` is not set. SSSD will search the entire "
+ "directory tree (%s) for sudoRole objects. This may allow any "
+ "LDAP principal with write access to any subtree to inject "
+ "sudo rules granting arbitrary privileges. Set "
+ "`ldap_sudo_search_base` to restrict the search scope "
+ "(e.g., 'ou=sudoers,dc=example,dc=com').\n",
+ sdom->naming_context);
+ sss_log(SSS_LOG_ALERT,
+ "`ldap_sudo_search_base` is not set. SSSD will search the entire "
+ "directory tree (%s) for sudoRole objects. This may allow any "
+ "LDAP principal with write access to any subtree to inject "
+ "sudo rules granting arbitrary privileges. Set "
+ "`ldap_sudo_search_base` to restrict the search scope "
+ "(e.g., 'ou=sudoers,dc=example,dc=com').",
+ sdom->naming_context);
ret = sdap_set_search_base(opts, sdom,
SDAP_SUDO_SEARCH_BASE,
sdom->naming_context);
diff --git a/src/tests/tests/system/tests/test_ldap.py b/src/tests/tests/system/tests/test_ldap.py
index 9e21d73f639..36d98847563 100644
--- a/src/tests/tests/system/tests/test_ldap.py
+++ b/src/tests/tests/system/tests/test_ldap.py
@@ -245,7 +245,7 @@ def test_ldap__search_base_is_discovered_and_defaults_to_root_dse(client: Client
client.sssd.dom("test")["ldap_search_base"] = ldap.ldap.naming_context
client.sssd.stop()
- client.sssd.clear()
+ client.sssd.clear(logs=True)
client.sssd.start()
assert client.auth.ssh.password("puser1", "Secret123"), "User 'puser1' login failed!"

26
2002-orabug32810448-restore-default-debug-sss_cache.patch Normal file
View File

@ -0,0 +1,26 @@
From: Alex Burmashev <alexander.burmashev@oracle.com>
Date: Tue, 04 May 2021 13:31:41 +0100
Subject: [PATCH] restore default debug level for sss_cache
We want only fatal failures to be logged, otherwise in some conditions log is.
flooded with unneeded "errors"
Resolves: https://github.com/SSSD/sssd/issues/5488
Orabug: 32810448
Signed-off-by: Alex Burmashev <alexander.burmashev@oracle.com>
Patch migrated from ol8 to ol9 without any modification
Signed-off-by: Darren Archibald <darren.archibald@oracle.com>
diff -uNr a/src/tools/sss_cache.c b/src/tools/sss_cache.c
--- a/src/tools/sss_cache.c 2024-06-26 02:11:39.000000000 -0700
+++ b/src/tools/sss_cache.c 2024-09-05 16:17:12.686336046 -0700
@@ -722,7 +722,7 @@
struct cache_tool_ctx *ctx = NULL;
int idb = INVALIDATE_NONE;
struct input_values values = { 0 };
- int debug = SSSDBG_TOOLS_DEFAULT;
+ int debug = SSSDBG_FATAL_FAILURE;
errno_t ret = EOK;
poptContext pc = NULL;

12
sssd.spec
View File

@ -21,17 +21,20 @@
Name: sssd
Version: 2.12.0
Release: 3%{?dist}
Release: 3.0.1%{?dist}.1
Summary: System Security Services Daemon
License: GPL-3.0-or-later
URL: https://github.com/SSSD/sssd/
Source0: https://github.com/SSSD/sssd/releases/download/2.12.0/sssd-2.12.0.tar.gz
Source1: sssd.sysusers
Patch2002: 2002-orabug32810448-restore-default-debug-sss_cache.patch
### Patches ###
Patch1: 0001-do-not-require-GID-for-non-POSIX-group.patch
Patch2: 0002-fix-use-after-free-in-kcm_read_options.patch
Patch3: 0003-do-not-update-cache-timeout-if-member-is-added.patch
Patch4: 0004-reject-path-traversal-in-gpcfilesyspath.patch
Patch5: 0005-warn-when-ldap_sudo_search_base-fallback.patch
### Dependencies ###
@ -1090,6 +1093,13 @@ fi
%systemd_postun_with_restart sssd.service
%changelog
* Mon Jul 20 2026 EL Errata <el-errata_ww@oracle.com> - 2.12.0-3.0.1.el10_2.1
- Restore default debug level for sss_cache [Orabug: 32810448]
* Wed Jul 8 2026 - Tomas Halman <thalman@redhat.com> - 2.12.0-3.1
- Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole
- Resolves: RHEL-192064 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass
* Tue Apr 14 2026 Tomas Halman <thalman@redhat.com> - 2.12.0-3
- Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work
- Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified