UB
Universal Blue•6d ago
Bloodfire

SSSD broken, unable to login since capabilities changes made to sssd-2.10.1

SSSD is currently broken in bazzite, meaning you can't login when using LDAP/FreeIPA/etc. Bazzite issue here: https://github.com/ublue-os/bazzite/issues/2030 This had a fix pushed through via rechunk here: https://github.com/hhd-dev/rechunk/pull/9 However, rechunk changes are not applying in the images built. You can see this here: https://github.com/ublue-os/bazzite/issues/2088 Right now this means anyone not using local login is stuck on 41.20241216.0 until the build-bot is fixed to appropriately apply the fix merged in the above PR. 
# Capabilities currently:
getcap /usr/libexec/sssd/*
/usr/libexec/sssd/krb5_child cap_chown,cap_dac_override,cap_setgid,cap_setuid=ep
/usr/libexec/sssd/ldap_child cap_chown,cap_dac_override,cap_setgid,cap_setuid=ep
/usr/libexec/sssd/selinux_child cap_setgid,cap_setuid=p
/usr/libexec/sssd/sssd_pam cap_dac_read_search=p

# Expected capabilities as per upstream changes:
/usr/libexec/sssd/krb5_child cap_dac_read_search,cap_setgid,cap_setuid=p
/usr/libexec/sssd/ldap_child cap_dac_read_search=p
/usr/libexec/sssd/selinux_child cap_setgid,cap_setuid=p 
/usr/libexec/sssd/sssd_pam cap_dac_read_search=p
# Capabilities currently:
getcap /usr/libexec/sssd/*
/usr/libexec/sssd/krb5_child cap_chown,cap_dac_override,cap_setgid,cap_setuid=ep
/usr/libexec/sssd/ldap_child cap_chown,cap_dac_override,cap_setgid,cap_setuid=ep
/usr/libexec/sssd/selinux_child cap_setgid,cap_setuid=p
/usr/libexec/sssd/sssd_pam cap_dac_read_search=p

# Expected capabilities as per upstream changes:
/usr/libexec/sssd/krb5_child cap_dac_read_search,cap_setgid,cap_setuid=p
/usr/libexec/sssd/ldap_child cap_dac_read_search=p
/usr/libexec/sssd/selinux_child cap_setgid,cap_setuid=p 
/usr/libexec/sssd/sssd_pam cap_dac_read_search=p
Hopefully the build bot can be fixed soon as this is a breaking change that prevents upgrades.
GitHub
SSSD binaries capabilities have changed · Issue #2030 · ublue-os/ba...
Describe the bug Followup to #1818 Since 41.20241229 sssd.service fails to start. Dec 29 23:20:23 <redacted> systemd[1]: Starting sssd.service - System Security Services Daemon... Dec 29 23:2...
GitHub
fix: add case statement for setting sssd capabilities based on Fedo...
To fix ublue-os/bazzite#2030 without breaking previous SSSD versions capabilities. I&#39;m not sure if there&#39;s a better place to put functions, but that could certainly be changed. I cr...
GitHub
Image build not including rechunk changes · Issue #2088 · ublue-os/...
Describe the bug It looks like rechunk is not applying the appropriate changes to the bazzite image, resulting in retained sssd failures. hhd-dev/rechunk#9 Which should fix: #2030 What did you expe...
7 Replies
Bloodfire
BloodfireOP•6d ago
Hoping posting it in the discord will increase visibility, referencing appropriate bazzite github issues pages to make it easier 🙂
wolfyreload
wolfyreload•6d ago
@antheas sorry to ping you. You might want to have a look at this.
antheas
antheas•6d ago
kyle said he'd update it did he @Kyle Gospo update it
Bloodfire
BloodfireOP•6d ago
Hello again @antheas thanks so much for your work last week on that PR 🙂 as of 41.20250106.2 it was still bork bork by the way. Is the build bot not upstream change aware? Feels like a trigger is not in place if that's the issue.
Kyle Gospo
Kyle Gospo•6d ago
Yeah testing should have the latest Stable will for the next build as well, it's there
antheas
antheas•6d ago
try testing
Bloodfire
BloodfireOP•7h ago
ok I'll rebase to testing after work unless new stable is released prior haha did not work but i see a new merge went into rechunk that address version detection fixes

Did you find this page helpful?