Wrong installation path for the sssd Python module

[Fabien Malfoy]

[ Impact ]

sssd users who try to invoke the "sssctl analyze" command on Ubuntu Jammy will experience the following error:

/usr/bin/env: ‘python’: No such file or directory

This happens because "sssctl analyze" will call /usr/libexec/sssd/sss_analyze, which uses "#!/usr/bin/env python" as its shebang. This is incorrect, as it should be using "python3" instead.

When this bug is fixed, another one pops up:

Traceback (most recent call last):
  File "/usr/libexec/sssd/sss_analyze", line 3, in <module>
    from sssd import sss_analyze
ModuleNotFoundError: No module named 'sssd'

This bug is happening because sssd-tools currently installs its Python files inside /usr/lib/python3.10/site-packages/sssd/, but the right path to install these files is /usr/lib/python3/dist-packages/sssd.

[ Test Plan ]

$ lxc launch ubuntu-daily:jammy sssd-bug1979453
$ lxc shell sssd-bug1979453
# apt update
# apt install -y sssd sssd-tools
# cat > /etc/sssd/sssd.conf << _EOF_
[sssd]
config_file_version = 2
services = pam
domains = example.com

[pam]

[domain/example.com]
id_provider = proxy
proxy_lib_name = files
auth_provider = krb5
krb5_server = localhost
krb5_realm = EXAMPLE.COM
_EOF_
# chmod 0600 /etc/sssd/sssd.conf
# sssctl analyze

With the current version of sssd available in Jammy, you should see the error messages listed above (in the "Impact") section. With a fixed sssd, you will see:

# sssctl analyze
usage: sss_analyze [-h] [--source {files,journald}] [--logdir LOGDIR] COMMANDS ...

Analyzer tool to assist with SSSD log parsing

options:
  -h, --help show this help message and exit
  --source {files,journald}
  --logdir LOGDIR SSSD Log directory to parse log files from

  COMMANDS
    Modules
      request Request tracking

[ Where problems could occur ]

This fix changes the path where sssd's Python files are installed. I believe this is the most problematic part of this SRU: although we doing "the right thing" here, there is always the possibility that someone might have a local script that somehow relies on the Python files to be where they currently are. This would obviously be an unsupported scenario, but nonetheless it could break this person's script. I find it highly unlikely that this will happen, though, because this bug did not exist until very recently ("sssctl analyze" has been introduced only on Jammy).

[ Original Description ]

Context
---------

```
# lsb_release -rd
Description: Ubuntu 22.04 LTS
Release: 22.04
```

 Symptoms
----------

The `/usr/libexec/sssd/sss_analyze` tool, invoked through `sssctl analyze`, is broken under Ubuntu 22.04:

```
# sssctl analyze --help
Traceback (most recent call last):
  File "/usr/libexec/sssd/sss_analyze", line 3, in <module>
    from sssd import sss_analyze
ModuleNotFoundError: No module named 'sssd'
Command '/usr/libexec/sssd/sss_analyze' failed with [1]
```

 Cause
-------

The tool is brought by the `sssd-tools` package, which also comes with the expected Python module named `sssd`:

```
# dpkg -S /usr/libexec/sssd/sss_analyze
sssd-tools: /usr/libexec/sssd/sss_analyze
# apt-cache show sssd-tools
Package: sssd-tools
Architecture: amd64
Version: 2.6.3-1ubuntu3
Priority: extra
Section: utils
Source: sssd
Origin: Ubuntu
...
Depends: python3, python3-sss, python3-systemd, sssd-common (= 2.6.3-1ubuntu3), libc6 (>= 2.34), libdhash1 (>= 0.4.0), libldb2 (>= 0.9.21), libpam0g (>= 0.99.7.1), libpopt0 (>= 1.14), libref-array1 (>= 0.4.0), libsss-certmap0 (>= 2.6.3), libtalloc2 (>= 2.0.4~git20101213)
...
Filename: pool/main/s/sssd/sssd-tools_2.6.3-1ubuntu3_amd64.deb
Size: 92454
MD5sum: ed023079efa434dbfefb0a11488be6be
SHA1: 28f44521c11ae93f774b907ef13aaec271f5db77
SHA256: b4954b7ec32bbc21fa77ecc5a68f3ddd682bf4408ad029bfc403367dc7dc657b
SHA512: 693eaa32af1dd9ffbbfc6a553ea9db72e76d9e5d1567da83d9356db21ad462927e4a3c20773f17a914115e89d1e62c66b28d529c52642d7f9f58d8d812113e83
...
# dpkg -L sssd-tools
...
/usr/lib/python3.10/site-packages/sssd
/usr/lib/python3.10/site-packages/sssd/__init__.py
/usr/lib/python3.10/site-packages/sssd/modules
/usr/lib/python3.10/site-packages/sssd/modules/__init__.py
/usr/lib/python3.10/site-packages/sssd/modules/request.py
/usr/lib/python3.10/site-packages/sssd/parser.py
/usr/lib/python3.10/site-packages/sssd/source_files.py
/usr/lib/python3.10/site-packages/sssd/source_journald.py
/usr/lib/python3.10/site-packages/sssd/source_reader.py
/usr/lib/python3.10/site-packages/sssd/sss_analyze.py
...
```

Unfortunately, it gets installed into the `site-packages` subdirectory of `/usr/lib/python3.10`, whereas Python is configured to only search the `dist-packages` subdir:

```
# python
Python 3.10.4 (main, Apr 2 2022, 09:04:19) [GCC 11.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import sys
>>> sys.path
['', '/usr/lib/python310.zip', '/usr/lib/python3.10', '/usr/lib/python3.10/lib-dynload', '/usr/local/lib/python3.10/dist-packages', '/usr/lib/python3/dist-packages']
```

 Solution proposal
-------------------

Ship a new release of the package with the module installed into `dist-packages` instead of `site-packages` under `/usr/lib/python3.10`.

[madigal (osse7)]

 usr.sbin.sssd Caching disabled on Kinetic Mate

    Just getting that warning while upgrading apparmor:

    Reloading AppArmor profiles
    Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
    Warning: found usr.sbin.sssd in /etc/apparmor.d/force-complain, forcing complain mode
    Warning from /etc/apparmor.d (/etc/apparmor.d/usr.sbin.sssd line 60): Caching disabled for: 'usr.sbin.sssd' due to force complain

[Launchpad Janitor (janitor)]

This bug was fixed in the package sssd - 2.7.2-3ubuntu1

---------------
sssd (2.7.2-3ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.

sssd (2.7.2-3) unstable; urgency=medium

  * d/p/fix-shebang-on-sss_analyze.patch: Fix shebang on sss_analyze.

sssd (2.7.2-2) unstable; urgency=medium

  * rules, install: Fix python install directory. (LP: #1979453)

 -- Sergio Durigan Junior <email address hidden> Thu, 23 Jun 2022 14:03:54 -0400

[Steve Langasek (vorlon)]

Hello Fabien, or anyone else affected,

Accepted sssd into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/sssd/2.6.3-1ubuntu3.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Jammy verification

Reproduced the error with the jammy packages:

root@sssd-bug1979453:~# apt-cache policy sssd
sssd:
  Installed: 2.6.3-1ubuntu3
  Candidate: 2.6.3-1ubuntu3
  Version table:
 *** 2.6.3-1ubuntu3 500
        500 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages

root@sssd-bug1979453:~# sssctl analyze
/usr/bin/env: ‘python’: No such file or directory
Command '/usr/libexec/sssd/sss_analyze' failed with [127]

Then I upgrade the package to the one in proposed:
root@sssd-bug1979453:~# apt-cache policy sssd
sssd:
  Installed: 2.6.3-1ubuntu3.1
  Candidate: 2.6.3-1ubuntu3.1
  Version table:
 *** 2.6.3-1ubuntu3.1 500
        500 http://archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages

And the error is gone and I get the expected help page:
root@sssd-bug1979453:~# sssctl analyze
usage: sss_analyze [-h] [--source {files,journald}] [--logdir LOGDIR] COMMANDS ...

Analyzer tool to assist with SSSD log parsing

options:
  -h, --help show this help message and exit
  --source {files,journald}
  --logdir LOGDIR SSSD Log directory to parse log files from

  COMMANDS
    Modules
      request Request tracking

Jammy verification succeeded.

[Launchpad Janitor (janitor)]

This bug was fixed in the package sssd - 2.6.3-1ubuntu3.1

---------------
sssd (2.6.3-1ubuntu3.1) jammy; urgency=medium

  * d/p/lp1934997-authentication-fails-gpo-non-existent.patch:
    Fix authentication failure when GPO is enabled and
    SecEdit/GptTmpl.inf is missing (LP: #1934997).
  * d/p/lp1979350-GPO-ignore-non-ascii-symbols-in-GPT.INI.patch:
    Ignore non-ASCII characters in GPT.INI. (LP: #1979350)
  * Fix "sssctl analyze" (LP: #1979453)
    [ Timo Aaltonen ]
    - d/{python3-libipa-hbac.install,python3-sss.install,
      sssd-tools.install,rules}: Fix Python installation directory
      path.
    [ Sergio Durigan Junior ]
    - d/p/lp1979453-fix-shebang-on-sss_analyze.patch: Fix shebang on
      sss_analyze.

 -- Sergio Durigan Junior <email address hidden> Wed, 22 Jun 2022 12:31:22 -0400

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for sssd has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.