|
Bugzilla – Full Text Bug Listing |
| Summary: | latest pam_mount affects zypper and sudo su | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE Tumbleweed | Reporter: | Martin Jedamzik <martin.jedamzik> |
| Component: | libzypp | Assignee: | E-mail List <zypp-maintainers> |
| Status: | RESOLVED FIXED | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Normal | ||
| Priority: | P5 - None | CC: | ma, martin.jedamzik |
| Version: | Current | ||
| Target Milestone: | --- | ||
| Hardware: | x86-64 | ||
| OS: | openSUSE Tumbleweed | ||
| Whiteboard: | |||
| Found By: | Field Engineer | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: |
supportconfig
Patch in case a PTF is needed |
||
|
Description
Martin Jedamzik
2021-05-28 13:01:01 UTC
Some more information: tumble:/home/testuser # pam-config --service su-l -a --mount tumble:/home/testuser # zypper lr ^C ( hangs ) tumble:/home/testuser # pam-config --service su-l -d --mount tumble:/home/testuser # zypper lr Repository priorities are without effect. All enabled repositories share the same priority. # | Alias | Name | Enabled | GPG Check | Refresh --+---------------------+-----------------------------+---------+-----------+-------- 1 | openSUSE-20200805-0 | openSUSE-20200805-0 | Yes | (r ) Yes | No 2 | repo-debug | openSUSE-Tumbleweed-Debug | No | ---- | ---- 3 | repo-non-oss | openSUSE-Tumbleweed-Non-Oss | Yes | (r ) Yes | Yes 4 | repo-oss | openSUSE-Tumbleweed-Oss | Yes | (r ) Yes | Yes 5 | repo-source | openSUSE-Tumbleweed-Source | No | ---- | ---- 6 | repo-update | openSUSE-Tumbleweed-Update | Yes | (r ) Yes | Yes Installing pam_mount-2.16-7.22.x86_64 from SLES15 SP2 makes it work again. Hm, I just tried this on a TW VM and could not reproduce! I did a "zypper dup" this morning, so it should be quite up-to-date. Can you please attach the supportconfig file here? Also, please list the names of files in "/etc/pam.d" and in "/usr/etc/pam.d" here. I'm also wondering whether pam-config gave any error messages, as "su-l" (from util-linux-2.36.2-1.18.x86_64) is now in "/usr/etc/pam.d" rather than "/etc/pam.d", and "pam-config" still has some issues with that. @Josef: No problem, I was able to narrow down the problem even further: Fresh Tumbleweed, minimal server installation: zypper in pam_mount supportutils echo 'testuser ALL=(ALL) NOPASSWD: /usr/bin/su' >> /etc/sudoers cp /usr/etc/pam.d/su-l /etc/pam.d/ https://en.opensuse.org/openSUSE:Packaging_UsrEtc pam-config --service su-l -a --mount As testuser: sudo su zypper lr ( fails ) pam-config --service su-l -d --mount zypper lr ( works ) Trying the same on SLES15 SP2 works. Supportconfig will follow. Created attachment 849981 [details]
supportconfig
Thanks, Martin.
I'm wondering why this works:
pam-config --service su-l -a --mount
The problem is that pam-config has a bug:
Initially, the PAM config file for "su -l" is "/usr/etc/pam.d/su-l" and "/etc/pam.d/su-l" does not exist. This is on purpose and "/usr/etc" is read-only on MicroOS and Transactional Server.
When you call "pam-config", it will read the config file from "/usr/etc/pam.d/su-l" but tries to write the modified file to "/etc/pam.d/su-l".
However, just before writing, it checks the readability of "/etc/pam.d/su-l", fails and exits. Thorsten Kukuk cannot remember why this check was ever there and who put it there, but we both agree it's definitely wrong.
Anyways ... I'll try this on a fresh TW and see what I can see ;-)
(In reply to Josef Möllers from comment #6) > Thanks, Martin. > > I'm wondering why this works: > pam-config --service su-l -a --mount Ah, sorry, I didn't see the "cp /usr/etc/pam.d/su-l /etc/pam.d/" :-( Hello Michael, Can you please look into this? What I have found out so far is: "zypper lr" invokes "/usr/bin/su -c umask -l root" which invokes PAM. The "su"-process eventually hangs within pam_mount.so which tries to obtain the "pam_mount password:" from stdin. Fd 0, however, is one side of a pipe, the other side is owned by zypper. As zypper is apparently unaware of "su" wanting anything, so the "su" hangs there forever. Feel free to re-assign back to me if you think that PAM can do anything about this. SLES15 SP3 now shows the same behavior. I will check it. Created attachment 852183 [details]
Patch in case a PTF is needed
Will be fixed in zypper 1.14.49
. openSUSE-RU-2021:3501-1: An update that has 15 recommended fixes and contains two features can now be installed. Category: recommended (moderate) Bug References: 1186503,1186602,1187224,1187425,1187466,1187738,1187760,1188156,1188435,1189031,1190059,1190199,1190465,1190712,1190815 CVE References: JIRA References: ECO-2911,SLE-16862 Sources used: openSUSE Leap 15.3 (src): libsolv-0.7.20-9.2, libzypp-17.28.5-15.2, protobuf-3.9.2-4.9.1, zypper-1.14.49-16.1 SUSE-RU-2021:3501-1: An update that has 15 recommended fixes and contains two features can now be installed. Category: recommended (moderate) Bug References: 1186503,1186602,1187224,1187425,1187466,1187738,1187760,1188156,1188435,1189031,1190059,1190199,1190465,1190712,1190815 CVE References: JIRA References: ECO-2911,SLE-16862 Sources used: SUSE MicroOS 5.1 (src): libsolv-0.7.20-9.2, libzypp-17.28.5-15.2, protobuf-3.9.2-4.9.1, zypper-1.14.49-16.1 SUSE MicroOS 5.0 (src): libsolv-0.7.20-9.2, libzypp-17.28.5-15.2, protobuf-3.9.2-4.9.1, zypper-1.14.49-16.1 SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (src): protobuf-3.9.2-4.9.1 SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (src): protobuf-3.9.2-4.9.1 SUSE Linux Enterprise Module for Public Cloud 15-SP3 (src): protobuf-3.9.2-4.9.1 SUSE Linux Enterprise Module for Public Cloud 15-SP2 (src): protobuf-3.9.2-4.9.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src): protobuf-3.9.2-4.9.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP2 (src): protobuf-3.9.2-4.9.1 SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): libsolv-0.7.20-9.2, protobuf-3.9.2-4.9.1 SUSE Linux Enterprise Module for Development Tools 15-SP2 (src): libsolv-0.7.20-9.2, protobuf-3.9.2-4.9.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): libsolv-0.7.20-9.2, libzypp-17.28.5-15.2, protobuf-3.9.2-4.9.1, zypper-1.14.49-16.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): libsolv-0.7.20-9.2, libzypp-17.28.5-15.2, protobuf-3.9.2-4.9.1, zypper-1.14.49-16.1 SUSE Linux Enterprise Installer 15-SP2 (src): libsolv-0.7.20-9.2, libzypp-17.28.5-15.2, protobuf-3.9.2-4.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-RU-2021:3780-1: An update that has 31 recommended fixes and contains one feature can now be installed. Category: recommended (moderate) Bug References: 1153687,1182372,1183268,1183589,1184326,1184399,1184997,1185325,1186447,1186503,1186602,1187224,1187425,1187466,1187738,1187760,1188156,1188435,1189031,1190059,1190199,1190356,1190465,1190712,1190815,1191286,1191324,1191370,1191609,1192337,1192436 CVE References: JIRA References: SLE-18858 Sources used: SUSE Linux Enterprise Server for SAP 15 (src): libsolv-0.7.20-3.48.1, libzypp-17.28.8-3.78.1, zypper-1.14.50-3.60.1 SUSE Linux Enterprise Server 15-LTSS (src): libsolv-0.7.20-3.48.1, libzypp-17.28.8-3.78.1, zypper-1.14.50-3.60.1 SUSE Linux Enterprise Installer 15 (src): libsolv-0.7.20-3.48.1, libzypp-17.28.8-3.78.1, zypper-1.14.50-3.60.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): libsolv-0.7.20-3.48.1, libzypp-17.28.8-3.78.1, zypper-1.14.50-3.60.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): libsolv-0.7.20-3.48.1, libzypp-17.28.8-3.78.1, zypper-1.14.50-3.60.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-RU-2021:3781-1: An update that has 31 recommended fixes and contains one feature can now be installed. Category: recommended (moderate) Bug References: 1153687,1182372,1183268,1183589,1184326,1184399,1184997,1185325,1186447,1186503,1186602,1187224,1187425,1187466,1187738,1187760,1188156,1188435,1189031,1190059,1190199,1190356,1190465,1190712,1190815,1191286,1191324,1191370,1191609,1192337,1192436 CVE References: JIRA References: SLE-18858 Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): libsolv-0.7.20-4.3.1, libzypp-17.28.8-3.61.1, zypper-1.14.50-3.46.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): libsolv-0.7.20-4.3.1, libzypp-17.28.8-3.61.1, zypper-1.14.50-3.46.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): libsolv-0.7.20-4.3.1, libzypp-17.28.8-3.61.1, zypper-1.14.50-3.46.1 SUSE Linux Enterprise Installer 15-SP1 (src): libsolv-0.7.20-4.3.1, libzypp-17.28.8-3.61.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): libsolv-0.7.20-4.3.1, libzypp-17.28.8-3.61.1, zypper-1.14.50-3.46.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): libsolv-0.7.20-4.3.1, libzypp-17.28.8-3.61.1, zypper-1.14.50-3.46.1 SUSE Enterprise Storage 6 (src): libsolv-0.7.20-4.3.1, libzypp-17.28.8-3.61.1, zypper-1.14.50-3.46.1 SUSE CaaS Platform 4.0 (src): libsolv-0.7.20-4.3.1, libzypp-17.28.8-3.61.1, zypper-1.14.50-3.46.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. |