Merge ~sergiodj/ubuntu/+source/openldap:bug1557157-groovy into ubuntu/+source/openldap:ubuntu/devel

[Sergio Durigan Junior]

When using openldap with sasl authentication, the slapd process will communicate with the saslauthd daemon via a socket in {,/var}/run/saslauthd/mux. Unfortunately, this will fail in every Ubuntu release from trusty onwards, because slapd's apparmor profile doesn't contain the necessary directive to allow it to read/write from/to the socket specified above.

This simple change implements the fix to allow the authentication process to happen.

It's possible to test it by doing:

$ lxc launch ubuntu-daily:groovy openldap-bugbug1557157-groovy
$ lxc shell openldap-bugbug1557157-groovy
# apt install slapd sasl2-bin ldap-utils apparmor-utils

(As the domain name, use "example.com").

# sed -i -e 's/^START=.*/START=yes/' /etc/default/saslauthd
# cat > /etc/ldap/sasl2/slapd.conf << __EOF__
mech_list: PLAIN
pwcheck_method: saslauthd
__EOF__
# adduser openldap sasl
# aa-enforce /etc/apparmor.d/usr.sbin.slapd
# systemctl restart slapd.service
# systemctl restart saslauthd.service
# passwd root

(You can choose any password here. You will need to type it when running the next command.)

# ldapsearch -H ldapi:/// -LLL -b 'dc=example,dc=com' -s base -U root -Y PLAIN

If you are using the fixed package, you will see something like:

SASL username: root
SASL SSF: 0
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: example
dc: example

There is a PPA here: https://launchpad.net/~sergiodj/+archive/ubuntu/openldap-bug1557157

autopkgtest is still happy:

autopkgtest [11:05:28]: test slapd: -----------------------]
autopkgtest [11:05:29]: test slapd: - - - - - - - - - - results - - - - - - - - - -
slapd PASS (superficial)
autopkgtest [11:05:30]: @@@@@@@@@@@@@@@@@@@@ summary
slapd PASS (superficial)

[Christian Ehrhardt  (paelzer)]

Change itself LGTM, is is small simple and reasonable.

But the groovy version number for an upload would need to be 2.4.50+dfsg-1ubuntu2

ultra-non-critical-bonus - double whitespace before the bug () in the changelog

review: Needs Fixing

[Sergio Durigan Junior (sergiodj)]

On Tuesday, June 16 2020, Christian Ehrhardt  wrote:

> Review: Needs Fixing
>
> Change itself LGTM, is is small simple and reasonable.
>
> But the groovy version number for an upload would need to be 2.4.50+dfsg-1ubuntu2

Sorry, you are correct. I fixed it and force-pushed, thanks!

> ultra-non-critical-bonus - double whitespace before the bug () in the changelog

"Fixed" as well :-). Years contributing to GNU causes these "side
effects" :-P.

Thanks,

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Christian Ehrhardt  (paelzer)]

LGTM now

review: Approve

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/ubuntu/+source/openldap
 * [new tag] upload/2.4.50+dfsg-1ubuntu2 -> upload/2.4.50+dfsg-1ubuntu2

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openldap_2.4.50+dfsg-1ubuntu2.dsc: done.
  Uploading openldap_2.4.50+dfsg-1ubuntu2.debian.tar.xz: done.
  Uploading openldap_2.4.50+dfsg-1ubuntu2_source.buildinfo: done.
  Uploading openldap_2.4.50+dfsg-1ubuntu2_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/apparmor-profile b/debian/apparmor-profile
index 793fa7b..9e1070f 100644
--- a/debian/apparmor-profile
+++ b/debian/apparmor-profile
@@ -1,5 +1,5 @@
 # vim:syntax=apparmor
-# Last Modified: Fri Jan  4 15:18:13 2008
+# Last Modified: Fri Jun  6 13:51:00 2020
 # Author: Jamie Strandboge <[e-mail]>
 
 #include <tunables/global>
@@ -49,6 +49,7 @@
   /{,var/}run/slapd/* w,
   /{,var/}run/slapd/ldapi rw,
   /{,var/}run/nslcd/socket rw,
+  /{,var/}run/saslauthd/mux rw,
 
   /usr/lib/ldap/ r,
   /usr/lib/ldap/* mr,
diff --git a/debian/changelog b/debian/changelog
index 504f29f..f8394c2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openldap (2.4.50+dfsg-1ubuntu2) groovy; urgency=medium
+
+  * d/apparmor-profile: Update apparmor profile to grant access to
+    the saslauthd socket, so that SASL authentication works. (LP: #1557157)
+
+ -- Sergio Durigan Junior <[e-mail]>  Fri, 12 Jun 2020 18:20:42 -0400
+
 openldap (2.4.50+dfsg-1ubuntu1) groovy; urgency=medium
 
   * Merge with Debian unstable. Remaining changes: