A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing to be ignored in the event that the access-provider is also handling the setup of the user's SELinux user context.
{ "availability": "No subscription required", "binaries": [ { "binary_name": "libipa-hbac-dev", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libipa-hbac0", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libipa-hbac0-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libnss-sss", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libnss-sss-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libpam-sss", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libpam-sss-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libsss-idmap-dev", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libsss-idmap0", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libsss-idmap0-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libsss-nss-idmap-dev", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libsss-nss-idmap0", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libsss-nss-idmap0-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libsss-simpleifp-dev", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libsss-simpleifp0", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libsss-simpleifp0-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libsss-sudo", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libsss-sudo-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libwbclient-sssd", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libwbclient-sssd-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "libwbclient-sssd-dev", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "python-libipa-hbac", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "python-libsss-nss-idmap", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "python-sss", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "python3-libipa-hbac", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "python3-libsss-nss-idmap", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "python3-sss", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-ad", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-ad-common", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-ad-common-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-ad-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-common", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-common-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-dbus", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-dbus-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-ipa", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-ipa-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-krb5", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-krb5-common", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-krb5-common-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-krb5-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-ldap", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-ldap-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-proxy", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-proxy-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-tools", "binary_version": "1.13.4-1ubuntu1.15" }, { "binary_name": "sssd-tools-dbgsym", "binary_version": "1.13.4-1ubuntu1.15" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_name": "libipa-hbac-dev", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libipa-hbac0", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libipa-hbac0-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libnss-sss", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libnss-sss-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libpam-sss", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libpam-sss-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-certmap-dev", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-certmap0", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-certmap0-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-idmap-dev", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-idmap0", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-idmap0-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-nss-idmap-dev", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-nss-idmap0", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-nss-idmap0-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-simpleifp-dev", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-simpleifp0", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-simpleifp0-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-sudo", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libsss-sudo-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libwbclient-sssd", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libwbclient-sssd-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "libwbclient-sssd-dev", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python-libipa-hbac", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python-libipa-hbac-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python-libsss-nss-idmap", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python-libsss-nss-idmap-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python-sss", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python-sss-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python3-libipa-hbac", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python3-libipa-hbac-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python3-libsss-nss-idmap", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python3-libsss-nss-idmap-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python3-sss", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "python3-sss-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-ad", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-ad-common", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-ad-common-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-ad-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-common", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-common-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-dbus", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-dbus-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-ipa", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-ipa-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-kcm", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-kcm-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-krb5", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-krb5-common", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-krb5-common-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-krb5-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-ldap", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-ldap-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-proxy", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-proxy-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-tools", "binary_version": "1.16.1-1ubuntu1.4" }, { "binary_name": "sssd-tools-dbgsym", "binary_version": "1.16.1-1ubuntu1.4" } ] }