Public bug reported:
Starting with a fresh Ubuntu 26.04 (Resolute) system, I installed
freeipa-client, and then ran "sudo ipa-client-install" as a local user
to join the system to an existing FreeIPA domain.
I then logged in to the newly-joined system using a FreeIPA account that
should have sudo rights via FreeIPA, and tried to run a command with
sudo.
Expectation: Sudo should work correctly using the centralized policy
from FreeIPA.
Result:
"sudo: I'm sorry <username>. I'm afraid I can't do that"
Findings:
Ubuntu 26.04 uses Rust-based sudo (sudo-rs) by default, which does not handle
centralized sudo policies, therefore the system does not work "as expected"
with FreeIPA even after joining it to the domain.
The install script should recognize that sudo-rs is in use and suggest
(maybe even automate) running "update-alternatives" to change sudo back
to "sudo.ws" (the only way to support SSSD and centralized sudo
administration). If Ubuntu does not continue to ship "sudo.ws" in the
future and forces everything to Rust-sudo, then I imagine centralized
FreeIPA sudo will eventually stop working (!!) on a future release of
Ubuntu.
(This is also a problem during an upgrade of a freeipa-joined system
from Ubuntu 24.04 to 26.04, but in that scenario I considered the bug to
be with ubuntu-release-upgrader. It can leave someone in a much stickier
situation as they could potentially _not_ have a functioning local
account with sudo access to resolve the problem. See bug 2172342 for
that report)
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: freeipa-client 4.13.1-1
ProcVersionSignature: Ubuntu 7.0.0-42.42-generic 7.0.14
Uname: Linux 7.0.0-42-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
CloudArchitecture: x86_64
CloudBuildName: server
CloudID: configdrive
CloudName: configdrive
CloudPlatform: configdrive
CloudSerial: 20261016
CloudSubPlatform: config-disk (/dev/sr0)
Date: Wed Oct 28 18:40:58 2026
ProcEnviron:
LANG=C.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
SourcePackage: freeipa
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: freeipa (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug cloud-image resolute
** Summary changed:
- FreeIPA Client on Ubuntu 26.04 does not insure system is using a version of
sudo that works with SSSD for IPA-managed sudo rules
+ FreeIPA Client on Ubuntu 26.04 does not ensure system is using a version of
sudo that works with SSSD for IPA-managed sudo rules
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172421
Title:
FreeIPA Client on Ubuntu 26.04 does not ensure system is using a
version of sudo that works with SSSD for IPA-managed sudo rules
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/freeipa/+bug/2172421/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
