Public bug reported:
I upgraded a functional FreeIPA-joined Ubuntu 24.04 LTS ("Noble") system
that was using centralized sudo rules to 26.04 ("Resolute"), and FreeIPA
accounts could no longer use sudo after the upgrade.
After digging around I realized this was because of the change to Rust-
based "sudo-rs" which does not support the sudoers plugin API or NSS
database lookups for sudoers.
Pre-upgrade, everything worked correctly on Noble. /etc/nsswitch.conf
included a "sudoers:" line of "files sss".
Post upgrade, my FreeIPA account ("bwm") could not run sudo with the
error message: "sudo: I'm sorry bwm. I'm afraid I can't do that". (Note
that FreeIPA *login* to the system did work correctly so I was not
entirely locked out; only the centralized sudo was impacted.)
Impact: If I had not had access to a non-FreeIPA local account with sudo
rights, I would not have been able to easily correct this problem (short
of "breaking in" with a separate boot path, which may not be possible in
the case of an encrypted system).
Expected behavior: the upgrader should check whether sssd is in use with
sudo rules, or look for the presence of "sss" in /etc/nsswitch.conf, and
keep the system on "sudo.ws" (instead of "sudo-rs") by using an
appropriate update-alternatives command during the upgrade process.
Silently replacing a 100% functional authentication system with a less-
functional one purely "because rust" is not user- or admin-friendly.
(For the record, I'm not anti-rust, I'm just annoyed by having to
troubleshoot an unexpectedly broken system.)
The apport file generated by "ubuntu-bug" from the impacted system is
attached, and I can provide more logs from /var/log/dist-upgrade (just
let me know which files are required).
** Affects: ubuntu-release-upgrader (Ubuntu)
Importance: Undecided
Status: New
** Attachment added: "Apport file from impacted system"
https://bugs.launchpad.net/bugs/2172342/+attachment/6013063/+files/apport.ubuntu-release-upgrader-core.xtyv391b.apport
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172342
Title:
Upgrading from 24.04 LTS to 26.04 LTS breaks SSSD/FreeIPA sudo by
switching default to sudo-rs without checking NSS configuration
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/+bug/2172342/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
