pam_cifscreds.so not supplied in package

Bug #1611816 reported by David McBride on 2016-08-10
16
This bug affects 2 people
Affects Status Importance Assigned to Milestone
cifs-utils (Debian)
Fix Released
Unknown
cifs-utils (Ubuntu)
Medium
Unassigned
Xenial
Medium
Unassigned
Yakkety
Medium
Brian Murray
Zesty
Medium
Unassigned

Bug Description

The cifs-utils source package contains the pam_cifscreds.so PAM module; however, this is not built and supplied in a resulting binary package. This is necessary functionality for our local managed deployment.

We have worked around this issue by building our own patched version of the package; however, this is liable to be clobbered by any future upstream updates. Hence, it would be valuable if our modifications, or some variant of them, could be adopted upstream.

The changes required are minimal; simply add libpam0g-dev to Build-Depends, and add some appropriate flags to ./configure in debian/rules to ensure the requisite library is built and installed in the correct location.

See attached patch.

## SRU Justification

[Impact]

As David has found, users are currently unable to use the cifscreds PAM module to unlock credentials at login because existing package doesn't compile the module along with the rest of the package.

Davids patch adds libpam-0g-dev to the Build depends, and amends the debian rules file so that the PAM module is built along with the rest of the application and installed into the correct location.

I'm requesting this to be backported to the existing releases, this change is a
feature which is highly desired in managed deployments, the changes are minimal and as this patch only adds functionality and is largely unobtrusive I see no reason for the Ubuntu community to benefit from its inclusion considering the regression potential is minimal.

This feature has been added to Zesty already as part of the merge done in LP: #1660372.

[Test Case]

Install the package and check for the existance of the PAM module at:
 /lib/x86_64-linux-gnu/security/pam_cifscreds.so

At present this file is missing as it isn't compiled along with the rest of the package.

[Regression Potential]

I've been testing this myself on a number of systems and have discovered no issues as yet, with this patch the supplied module is built and placed into the correct location, as is the manpage, and both perform as intended.

This change has an overall low chance of regression as it's only adding functionality should already be there.

The only regression I could think of is that for some reason the patch could result in some of the other binaries being linked against PAM (and potentially have their behavior changed) as a result of the addition of PAM, but I find this extremely unlikely, and I have verified that PAM isn't linked to except for pam_cifscreds.so so I find the possibility of this happening negligible.

Documentation for the feature is provided as a manpage and is distributed along with the updated package.

The attachment "Suggested modifications to debian/{rules,control}" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags: added: patch
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in cifs-utils (Ubuntu):
status: New → Confirmed
Changed in cifs-utils (Debian):
status: Unknown → New
Changed in cifs-utils (Debian):
status: New → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cifs-utils - 2:6.6-5ubuntu1

---------------
cifs-utils (2:6.6-5ubuntu1) zesty; urgency=low

  * Merge from Debian unstable (LP: #1660372). Remaining changes:
    - debian/patches/stat_systemd-ask-password.patch: also check for
      /bin/systemd-ask-password before trying to use systemd's tools.

cifs-utils (2:6.6-5) unstable; urgency=low

  * Set architecture to linux-any.

cifs-utils (2:6.6-4) unstable; urgency=medium

  * Add pam_cifscreds (Closes: #848140, LP: #1611816). Patch by David Mcbride

cifs-utils (2:6.6-3) unstable; urgency=medium

  * Use correct idmapwb.so path in postinst/prerm (Closes: #848275)

cifs-utils (2:6.6-2) unstable; urgency=medium

  * Add me to uploaders
  * Create idmap-plugin symlink using update-alternatives (Closes: #845532).
    Thanks Alessandro Larcher for reporting.

cifs-utils (2:6.6-1) unstable; urgency=medium

  * Team upload
  * New upstream release

 -- Dave Chiluk <email address hidden> Tue, 03 May 2016 17:30:11 +0000

Changed in cifs-utils (Ubuntu):
status: Confirmed → Fix Released
Keith Ward (kward) on 2017-02-06
description: updated
Keith Ward (kward) on 2017-02-06
Changed in cifs-utils (Ubuntu Xenial):
status: New → In Progress
assignee: nobody → Keith Ward (keithward)
Keith Ward (kward) wrote :

Attaching Debdiff against Xenial 6.4-1_ubuntu1

Changed in cifs-utils (Ubuntu Yakkety):
assignee: nobody → Keith Ward (keithward)
status: New → In Progress
Keith Ward (kward) wrote :

Attaching debdiff against Yakkety - 6.5-2ubuntu1

Keith Ward (kward) wrote :

Subscribed Ubuntu-Sponsors as I don't have ability to upload directly.

Keith Ward (kward) on 2017-02-06
Changed in cifs-utils (Ubuntu Xenial):
status: In Progress → Confirmed
Changed in cifs-utils (Ubuntu Yakkety):
status: In Progress → Confirmed
Changed in cifs-utils (Ubuntu Xenial):
assignee: Keith Ward (keithward) → nobody
Changed in cifs-utils (Ubuntu Yakkety):
assignee: Keith Ward (keithward) → nobody
Changed in cifs-utils (Ubuntu Yakkety):
importance: Undecided → Medium
Changed in cifs-utils (Ubuntu Zesty):
importance: Undecided → Medium
Changed in cifs-utils (Ubuntu Xenial):
importance: Undecided → Medium
Brian Murray (brian-murray) wrote :

I've uploaded this to the SRU queues for review by the SRU team. Thanks!

Changed in cifs-utils (Ubuntu Yakkety):
status: Confirmed → In Progress
Changed in cifs-utils (Ubuntu Xenial):
status: Confirmed → In Progress
Changed in cifs-utils (Ubuntu Yakkety):
assignee: nobody → Brian Murray (brian-murray)

Hello David, or anyone else affected,

Accepted cifs-utils into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cifs-utils/2:6.5-2ubuntu2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in cifs-utils (Ubuntu Yakkety):
status: In Progress → Fix Committed
tags: added: verification-needed
Changed in cifs-utils (Ubuntu Xenial):
status: In Progress → Fix Committed
Łukasz Zemczak (sil2100) wrote :

Hello David, or anyone else affected,

Accepted cifs-utils into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/cifs-utils/2:6.4-1ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Félix C. Morency (colibry10) wrote :

Could this be easily backported to Trusty?

David McBride (david-mcbride) wrote :

I have successfully tested version 2:6.4-1ubuntu1.1 on Xenial, and assert that the new version of the package works for me. Thanks!

tags: added: verification-done-xenial
Robie Basak (racb) wrote :

13:07 <rbasak> bdmurray: opinion on releasing bug 1611816 to xenial-updates? It's not verified on Yakkety, and it seems unlikely that anyone will. So that would create a feature regression on Xenial->Yakkety upgrade ("any such feature must then also be added to any newer supported Ubuntu release")

13:08 <rbasak> So should I hold releasing pending verification of Yakkety as well?

@David, thank you for verifying 2:6.4-1ubuntu1.1 on Xenial for us. I'm not sure if I should release to xenial-updates if I cannot also release to yakkety-updates, and I've asked the question. In the meantime, if you could verification the package in yakkety-proposed anyway, that would help regardless.

Andreas Hasenack (ahasenack) wrote :

I'm going to verify this for yakkety.

Andreas Hasenack (ahasenack) wrote :

(unless someone beats me to it, of course :)

Andreas Hasenack (ahasenack) wrote :

Verification for yakkety amd64:

package from proposed:
  Version table:
 *** 2:6.5-2ubuntu2 500
        500 http://br.archive.ubuntu.com/ubuntu yakkety-proposed/main amd64 Packages

PAM module is installed:
root@15-89:~# ll /lib/x86_64-linux-gnu/security/pam_cifscreds.so
-rw-r--r-- 1 root root 14176 Feb 28 21:58 /lib/x86_64-linux-gnu/security/pam_cifscreds.so

/etc/pam.d/login file modified to include pam_keyinit and pam_cifscreds: http://pastebin.ubuntu.com/24455401/

Mounted a samba share as root and connecting user "andreas" with the multiuser option:
root@15-89:~# mount -t cifs //ds216.lowtech/downloads /downloads -o username=andreas,multiuser
Password for andreas@//ds216.lowtech/downloads: ************************
root@15-89:~# ll /downloads/
total 414032
drwxrwxrwx 1 root root 0 Apr 20 20:23 ./
drwxr-xr-x 25 root root 4096 Apr 25 17:33 ../
drwxr-xr-x 1 1026 users 0 Aug 14 2016 humblebundle/
drwxr-xr-x 1 1026 users 0 Aug 18 2016 isos/
-rw-r--r-- 1 1026 users 265777840 Sep 9 2014 KSP_demo_linux.zip
(...)

Verified user ubuntu cannot see that:
root@15-89:~# sudo -u ubuntu -H ls -l /downloads/
ls: cannot access '/downloads/': Permission denied

Switch to a terminal and login as ubuntu, using the same password that the ubuntu user has on the samba share:

15-89 login: ubuntu
Password:
Last login: Tue Apr 25 17:34:30 UTC 2017 from 10.0.5.1 on pts/1
Welcome to Ubuntu 16.10 (GNU/Linux 4.8.0-49-generic x86_64)
(...)

Verify we have a cifs logon key in the kernel keyring:
ubuntu@15-89:~$ keyctl show
Session Keyring
 595619243 --alswrv 1000 1000 keyring: _ses
 525246747 --alswrv 1000 65534 \_ keyring: _uid.1000
 470618469 ----sw-v 0 0 \_ logon: cifs:a:10.10.222.255

And we can see the /downloads share now:
ubuntu@15-89:~$ ls -lah /downloads/
total 405M
dr-xr-xr-x 1 root root 0 Apr 20 20:23 .
drwxr-xr-x 25 root root 4.0K Apr 25 17:33 ..
drwxr-xr-x 1 1026 users 0 Aug 14 2016 humblebundle
drwxr-xr-x 1 1026 users 0 Aug 18 2016 isos
-rw-r--r-- 1 1026 users 254M Sep 9 2014 KSP_demo_linux.zip
(...)

Meanwhile, /var/log/syslog has this to say:
Apr 25 17:34:46 15-89 login[1237]: pam_cifscreds(login:auth): password stored
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): OPEN 1
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): UID:1000 [0] GID:1000 [0]
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): GET SESSION = 993549428
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): GET SESSION = 993549428
Apr 25 17:34:46 15-89 login[1237]: pam_keyinit(login:session): JOIN = 595619243

And /var/log/auth.log:
Apr 25 17:34:46 15-89 login[1237]: pam_cifscreds(login:session): credential key for \\10.10.222.255\ubuntu added

tags: added: verification-done-yakkety
tags: removed: verification-needed
Andreas Hasenack (ahasenack) wrote :

For the record, I also tried yakkety on i386:

 *** 2:6.5-2ubuntu2 500
        500 http://br.archive.ubuntu.com/ubuntu yakkety-proposed/main i386 Packages

root@22-96:~# ll /lib/i386-linux-gnu/security/pam_cifscreds.so
-rw-r--r-- 1 root root 13568 Feb 28 21:58 /lib/i386-linux-gnu/security/pam_cifscreds.so

I performed the same test as for amd64 and it also worked.

==> /var/log/auth.log <==
Apr 25 18:51:23 22-96 login[1155]: pam_cifscreds(login:session): credential key for \\10.10.222.255\ubuntu added

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cifs-utils - 2:6.5-2ubuntu2

---------------
cifs-utils (2:6.5-2ubuntu2) yakkety; urgency=low

  * Add pam_cifscreds (LP: #1611816). Patch by David McBride.

 -- Keith Ward <email address hidden> Tue, 28 Feb 2017 13:58:35 -0800

Changed in cifs-utils (Ubuntu Yakkety):
status: Fix Committed → Fix Released

The verification of the Stable Release Update for cifs-utils has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cifs-utils - 2:6.4-1ubuntu1.1

---------------
cifs-utils (2:6.4-1ubuntu1.1) xenial; urgency=low

  * Add pam_cifscreds (LP: #1611816). Patch by David McBride.

 -- Keith Ward <email address hidden> Tue, 28 Feb 2017 14:01:32 -0800

Changed in cifs-utils (Ubuntu Xenial):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.