SSSD / sssd

#3939 Remote secure_path attribute not used
Closed: Invalid by jhrozek. Opened by ulicar.

Closed: Invalid
Reopen Issue

I've locate this issue (https://www.redhat.com/archives/freeipa-users/2017-February/msg00202.html) seems like it's not solved yet.

So,

Local /etc/sudoers file has set secure_path
Defaults secure_path = /sbin:/bin:/usr/sbin:/usr/bin

And i have a domain user that wished to run sudo /usr/local/bin/executable
So I created a rule for him (enabled nopassd and added secure_path attribute)

[user@domain@server ~]$ sudo -ll
Matching Defaults entries for user@domain on server:
    !visiblepw, always_set_home, match_group_by_gid, env_reset, env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS", env_keep+="MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
    env_keep+="LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
    secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin
User user@domain may run the following commands on server:
SSSD Role: allow_sudo_executable_nopassword
    RunAsUsers: ALL
    RunAsGroups: ALL
    Options: !authenticate, secure_path=/usr/local/bin
    Commands:
    /usr/local/bin/executable

I get an answer that "sudo: executable: command not found"
However, it works if I add secure_path=/usr/local/bin to /etc/sudoers.d/secure_path.
Also, If i remove secure_path remote SSSD rule, it will work fine as well

I wish to be able to add attribues to remote SSSD rule, that will overwrite/append local secure_path from /etc/sudoers

cc @pbrezina do you have some idea?

As far as I understand it, secure_path set in sudoers like Defaults secure_path=... corresponds to sudoOption=secure_path=... in cn=defaults rule. To translate it to IPA, you need to create rule named defaults and set it here.

From what I can see in my tests is:

  1. If you set secure_path in rules named defaults or in sudoers directly and you call sudo cmd it will location cmd in secure_path and execute it if found, setting its PATH environment variable to the value of secure_path.
  2. If you set secure_path in rule allowing the command and run sudo cmd, sudo locates cmd in current path (either secure_path from defaults rule or from sudoers), then executes the command and set its PATH to secure_path from this rule.

If this does not meet your expectation you need to file a bug against sudo. SSSD merely forwards the rules to sudo, it is up to sudo how it evaluates them.

Metadata Update from @jhrozek:
- Issue close_status updated to: Invalid
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4919

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
High
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.