GPO application fails with more > 1host in security filter

[fdalfa]

Hello,

I'm using sssd 2.9.4 on RHEL8 (2.9.4-3.el8_10) with the following scenario: two linux machines are joined to an MS-AD domain, machines are in a specific OU with a GPO linked to it, the GPO has a security filter with two machines.
The GPO is applied on first machine, and is not applied on the second machine; here the log from the second one

(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_filter_gpos_by_dacl] (0x0400): [RID#7] examining dacl candidate_gpo_guid:{A8282E6A-7A7A-4148-B9E5-F2C26FB15950}
..
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_evaluate_dacl] (0x0400): [RID#7] GPO denied (security);  Trustee: S-1-5-21-1384148484-2853517914-4044072970-4618
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_filter_gpos_by_dacl] (0x0400): [RID#7] GPO not applicable to target per security filtering: result of DACL evaluation

A8282E6A-7A7A-4148-B9E5-F2C26FB15950 is GUID of not-applied GPO, S-1-5-21-1384148484-2853517914-4044072970-461 is the SID of the first machine in the filter.
If I remote the first machine from the filter, the GPO is applied as expected

(2024-06-05 10:17:08): [be[a.b.c]] [ad_gpo_filter_gpos_by_dacl] (0x0400): [RID#6] examining dacl candidate_gpo_guid:{A8282E6A-7A7A-4148-B9E5-F2C26FB15950}
..
(2024-06-05 10:17:08): [be[a.b.c]] [ad_gpo_filter_gpos_by_dacl] (0x0400): [RID#6] GPO applicable to target per security filtering

It looks like evalution of DACL halts on first non-matching SID.

regards,
Fabrizio

[sumit-bose]

Hi,

thank you for your report. You have omitted some log lines in your first log snippet, can you send the full snippet?

bye,
Sumit

[fdalfa]

Sure

(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_filter_gpos_by_dacl] (0x0400): [RID#7] examining dacl candidate_gpo_guid:{A8282E6A-7A7A-4148-B9E5-F2C26FB15950}
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_ace_includes_client_sid] (0x0020): [RID#7] sss_idmap_sid_to_smb_sid() failed for group_sid '^A': 6
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_evaluate_dacl] (0x0080): [RID#7] Could not determine if ACE is applicable;  Trustee: S-1-5-21-1384148484-2853517914-4044072970-4618
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_ace_includes_client_sid] (0x0020): [RID#7] sss_idmap_sid_to_smb_sid() failed for group_sid '^A': 6
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_evaluate_dacl] (0x0080): [RID#7] Could not determine if ACE is applicable;  Trustee: S-1-5-21-1384148484-2853517914-4044072970-512
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_ace_includes_client_sid] (0x0020): [RID#7] sss_idmap_sid_to_smb_sid() failed for group_sid '^A': 6
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_evaluate_dacl] (0x0080): [RID#7] Could not determine if ACE is applicable;  Trustee: S-1-5-21-1384148484-2853517914-4044072970-4618
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_ace_includes_client_sid] (0x0020): [RID#7] sss_idmap_sid_to_smb_sid() failed for group_sid '^A': 6
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_evaluate_dacl] (0x0080): [RID#7] Could not determine if ACE is applicable;  Trustee: S-1-5-21-1384148484-2853517914-4044072970-512
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_ace_includes_client_sid] (0x0020): [RID#7] sss_idmap_sid_to_smb_sid() failed for group_sid '^A': 6
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_evaluate_dacl] (0x0080): [RID#7] Could not determine if ACE is applicable;  Trustee: S-1-5-21-1384148484-2853517914-4044072970-519
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_ace_includes_client_sid] (0x0020): [RID#7] sss_idmap_sid_to_smb_sid() failed for group_sid '^A': 6
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_evaluate_dacl] (0x0080): [RID#7] Could not determine if ACE is applicable;  Trustee: S-1-5-9
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_ace_includes_client_sid] (0x0020): [RID#7] sss_idmap_sid_to_smb_sid() failed for group_sid '^A': 6
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_evaluate_dacl] (0x0080): [RID#7] Could not determine if ACE is applicable;  Trustee: S-1-5-18
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_ace_includes_client_sid] (0x0020): [RID#7] sss_idmap_sid_to_smb_sid() failed for group_sid '^A': 6
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_evaluate_dacl] (0x0400): [RID#7] GPO denied (security);  Trustee: S-1-5-21-1384148484-2853517914-4044072970-4618
(2024-06-04 15:32:52): [be[a.b.c]] [ad_gpo_filter_gpos_by_dacl] (0x0400): [RID#7] GPO not applicable to target per security filtering: result of DACL evaluation

FYI the SID of machine where the application of GPO fails is S-1-5-21-1384148484-2853517914-4044072970-5108

[sumit-bose]

Hi,

thanks, this looks like there is some invalid data or a binary SID in the list where SID strings were expected. Would it be possible to send the full backend log, the gpo_child.log and the cache file /var/lib/sss/db/cache_YOUR.DOMAIN.NAME.ldb? You can send it by email, if you prefer; the user name would be 'sbose' and the email domain is 'redhat.com'.

bye,
Sumit

[alexey-tikhonov]

https://issues.redhat.com/browse/RHEL-40570

[fdalfa]

Ciao,

The fix works! Thanks.

regards,
Fabrizio

[alexey-tikhonov]

The fix works! Thanks

Did you build from sources?

(I'll keep ticket open until fix is merged into the code base)

[fdalfa]

Did you build from sources?
Onestly no; @sumit-bose kindly sent me some prebuilt packages.

(I'll keep ticket open until fix is merged into the code base)
(Y)

regards,
Fabrizio

[alexey-tikhonov]

Pushed PR: #7421

• master
  • b25e510 - ad: use right memory context in GPO code
• sssd-2-9
  • 723a30b - ad: use right memory context in GPO code