Hi Gioele, hi Marc, On Mo 05 Okt 2026 03:41:46 CEST, Gioele Barabucci wrote:
On 10/4/26 08:48, Mike Gabriel wrote:It looks like I'll go with option 2. To make sure that the tested code matches the reality, can you please confirm my reading of the solution you agreed upon in the other bugs?From <https://bugs.debian.org/1147179#30>: ## sudo sudoers database-add sudoers first files ## libsss-sudo Pre-Depends: sudo (>= $some-version) sudoers database-require sudoers after=files sssConfirming! That's the proposed solution, indeed.Hi, I have uploaded dh-nss v1.8~exp2 to experimental. The new code should fix the issue that affect sssd and sudo (although many other problems are still lurking.)Please test. I'll wait for your feedback before uploading v1.8 to unstable. Regards, -- Gioele Barabucci
I think we are good to go with dh-nss v1.8.I ran various installation and upgrade tests now and v1.8 seems stable enough to cover all upgrade/installation pathways I have tested:
* [x] neither sudo, nor libsss-sudo installed; install my sudo, nsswitch.conf: sudoers: files * [x] neither sudo, nor libsss-sudo installed; install both of my package versions, nsswitch.conf: sudoers: files sss * [x] sudo installed, upgrade to new sudo version with sudo.nss included, nsswitch.conf: sudoers: files * [x] sudo installed, manual change of nsswitch.conf: sudoers: ldap, install new sudo version, nsswitch.conf: sudoers: files ldap * [x] sudo installed, manual change of nsswitch.conf: sudoers: ldap, install new sudo and new libsss-sudo version, nsswitch.conf: sudoers: files ldap sss (note, that I'll probably go with "sudoers last sss" in libsss-sudo.nss) * [x] sudo installed, libsss-sudo installed, upgrade to my local pkg versions, nsswitch.conf: sudoers: files sss
* etc. (I guess I tested some more, but did not write them all down) The .debdiffs I used: sudo: ```locadm@libsss-sudo-1129522:~$ debdiff sudo_1.9.17p2-9.dsc sudo_1.9.17p2-9.1.dsc
diff -Nru sudo-1.9.17p2/debian/changelog sudo-1.9.17p2/debian/changelog --- sudo-1.9.17p2/debian/changelog 2026-09-28 12:40:42.000000000 +0000 +++ sudo-1.9.17p2/debian/changelog 2026-10-09 05:39:58.000000000 +0000 @@ -1,3 +1,10 @@ +sudo (1.9.17p2-9.1) UNRELEASED; urgency=medium + + * debian/sudo.nss: + + Authoritatively manage sudoers: entry in nsswitch.conf. + + -- <[email protected]> Fri, 09 Oct 2026 05:39:58 +0000 + sudo (1.9.17p2-9) unstable; urgency=medium * Apply upstream patches to address CVE-2026-96512. diff -Nru sudo-1.9.17p2/debian/control sudo-1.9.17p2/debian/control --- sudo-1.9.17p2/debian/control 2026-09-28 12:40:42.000000000 +0000 +++ sudo-1.9.17p2/debian/control 2026-10-09 05:39:58.000000000 +0000 @@ -10,6 +10,7 @@ Build-Depends: debhelper-compat (= 13), dh-sequence-installnss, + dh-nss (>= 1.8~), Build-Depends-Arch: autoconf, bison, diff -Nru sudo-1.9.17p2/debian/sudo.nss sudo-1.9.17p2/debian/sudo.nss --- sudo-1.9.17p2/debian/sudo.nss 1970-01-01 00:00:00.000000000 +0000 +++ sudo-1.9.17p2/debian/sudo.nss 2026-09-09 20:34:35.000000000 +0000 @@ -0,0 +1,3 @@ +sudoers database-add + +sudoers first files ``` sssd: ``` locadm@libsss-sudo-1129522:~$ debdiff sssd_2.13.1-3.dsc sssd_2.13.1-3.1.dsc diff -Nru sssd-2.13.1/debian/changelog sssd-2.13.1/debian/changelog --- sssd-2.13.1/debian/changelog 2026-09-08 11:05:35.000000000 +0000 +++ sssd-2.13.1/debian/changelog 2026-10-09 04:20:16.000000000 +0000 @@ -1,3 +1,15 @@ +sssd (2.13.1-3.1) UNRELEASED; urgency=medium + + * Rebuild against dh-nss 1.8~. + * debian/libsss-sudo: + + Adjust rules, expect sudo bin:pkg to own the sudoers: entry in + nsswitch.conf. + * debian/patches: + + Add gdm-51-pam-extension-macros-compat.patch. Fix building against + libgdm-dev (>= 51). + + -- <[email protected]> Fri, 09 Oct 2026 04:20:16 +0000 + sssd (2.13.1-3) unstable; urgency=medium* debian/tests/control: Explicitly have tests requiring openssh-client depend
diff -Nru sssd-2.13.1/debian/control sssd-2.13.1/debian/control
--- sssd-2.13.1/debian/control 2026-09-08 11:05:33.000000000 +0000
+++ sssd-2.13.1/debian/control 2026-10-09 04:20:16.000000000 +0000
@@ -12,6 +12,7 @@
dh-apparmor,
dh-python,
dh-sequence-installnss,
+ dh-nss (>= 1.8~),
bind9-dnsutils,
docbook-xml,
docbook-xsl,
@@ -372,6 +373,7 @@
Package: libsss-sudo
Section: libs
Architecture: any
+Pre-Depends: ${misc:Pre-Depends}, sudo (>= 1.9.17p2-9.1~)
Depends: ${misc:Depends}, ${shlibs:Depends}
Description: Communicator library for sudo
Utility library to allow communication between sudo and SSSD for caching
diff -Nru sssd-2.13.1/debian/libsss-sudo.nss
sssd-2.13.1/debian/libsss-sudo.nss
--- sssd-2.13.1/debian/libsss-sudo.nss 2026-09-08 11:05:33.000000000 +0000 +++ sssd-2.13.1/debian/libsss-sudo.nss 2026-10-09 04:20:16.000000000 +0000 @@ -1,3 +1,3 @@ -sudoers database-add +sudoers database-require sudoers last sssdiff -Nru sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch --- sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch 1970-01-01 00:00:00.000000000 +0000 +++ sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch 2026-10-09 04:20:16.000000000 +0000
@@ -0,0 +1,54 @@ +Description: Fix FTBFS with GDM 51 PAM extension headers + GDM 51 rewrote its gdm-pam-extensions headers, replacing the uppercase + function-like macros with static inline functions. +Author: Renan Rodrigo <[email protected]> +Bug-Ubuntu: https://bugs.launchpad.net/bugs/2163336 +Forwarded: https://github.com/SSSD/sssd/pull/9076 +Last-Update: 2026-08-12 +--- +This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ +Index: sssd-2.13.1/src/sss_client/pam_sss.c +=================================================================== +--- sssd-2.13.1.orig/src/sss_client/pam_sss.c ++++ sssd-2.13.1/src/sss_client/pam_sss.c +@@ -67,6 +67,40 @@ + #endif + #endif /* HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION */ + ++/* GDM 51 replaced the uppercase function-like macros of its PAM extension ++ * headers with lowercase static inline functions. Provide the old macro ++ * names as aliases so the code below keeps compiling with both old and new ++ * gdm-pam-extensions. */ ++#ifdef HAVE_GDM_PAM_EXTENSIONS ++#ifndef GDM_PAM_EXTENSION_SUPPORTED ++#define GDM_PAM_EXTENSION_SUPPORTED(name) \ ++ gdm_pam_extension_supported(name) ++#endif ++#ifndef GDM_PAM_EXTENSION_MESSAGE_TO_BINARY_PROMPT_MESSAGE++#define GDM_PAM_EXTENSION_MESSAGE_TO_BINARY_PROMPT_MESSAGE(extended_message, binary_message) \ ++ gdm_pam_extension_message_to_binary_prompt_message((GdmPamExtensionMessage *)(extended_message), binary_message)
++#endif ++#ifndef GDM_PAM_EXTENSION_CHOICE_LIST_REQUEST_INIT++#define GDM_PAM_EXTENSION_CHOICE_LIST_REQUEST_INIT(request, title, num_items) \
++ gdm_pam_extension_choice_list_request_init(request, title, num_items) ++#endif ++#ifndef GDM_PAM_EXTENSION_REPLY_TO_CHOICE_LIST_RESPONSE ++#define GDM_PAM_EXTENSION_REPLY_TO_CHOICE_LIST_RESPONSE(reply) \ ++ gdm_pam_extension_reply_to_choice_list_response(reply) ++#endif ++#endif /* HAVE_GDM_PAM_EXTENSIONS */ ++ ++#ifdef HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION ++#ifndef GDM_PAM_EXTENSION_CUSTOM_JSON_REQUEST_INIT++#define GDM_PAM_EXTENSION_CUSTOM_JSON_REQUEST_INIT(request, proto_name, proto_version, json_str) \ ++ gdm_pam_extension_custom_json_request_init(request, proto_name, proto_version, json_str)
++#endif ++#ifndef GDM_PAM_EXTENSION_REPLY_TO_CUSTOM_JSON_RESPONSE ++#define GDM_PAM_EXTENSION_REPLY_TO_CUSTOM_JSON_RESPONSE(reply) \ ++ gdm_pam_extension_reply_to_custom_json_response(reply) ++#endif ++#endif /* HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION */ ++ + #include "sss_pam_compat.h" + #include "sss_pam_macros.h" + diff -Nru sssd-2.13.1/debian/patches/series sssd-2.13.1/debian/patches/series --- sssd-2.13.1/debian/patches/series 2026-09-08 11:05:33.000000000 +0000 +++ sssd-2.13.1/debian/patches/series 2026-10-09 04:20:16.000000000 +0000 @@ -9,3 +9,4 @@ CVE-2026-68742.diff CVE-2026-68743.diff CVE-2026-68744.diff +gdm-51-pam-extension-macros-compat.patch ``` Greets, Mike -- mike gabriel aka sunweaver (Debian Developer) mobile: +49 (1520) 1976 148 landline: +49 (4351) 486 14 27 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: [email protected], http://sunweavers.net
pgp88WPJzgXU1.pgp
Description: Digitale PGP-Signatur
