sudo fails with host netgroup returned from freeipa

Status changed to 'Confirmed' because the bug affects multiple users.

preliminary build for xenial:

http://koti.kapsi.fi/~tjaalton/lp1607666

included this patch too:
https://www.sudo.ws/repos/sudo/rev/50d8d88bcc28

Can confirm that this seems to work for us.

This bug was fixed in the package sudo - 1.8.19p1-1ubuntu1

---------------
sudo (1.8.19p1-1ubuntu1) zesty; urgency=low

  * Merge from Debian unstable. (LP: #1607666)
    Remaining changes:
    - Use tmpfs location to store timestamp files
      + debian/rules: change --with-rundir to /var/run/sudo
      + debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
        shipping init script and service file, as they are no longer
        necessary.
      + debian/*.preinst, debian/*.postinst, debian/*.postrm: remove old
        init script with dpkg-maintscript-helper.
      + debian/*.postinst: remove old /var/run/sudo to /var/lib/sudo
        transition code, remove old /var/lib/sudo/ts timestamp directory.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/control, debian/rules:
      + use dh-autoreconf
    - Remaining patches:
      + keep_home_by_default.patch: Keep HOME in the default environment
    - Dropped patches no longer needed:
      + debian/patches/lp1565567.patch: upstream.
      + debian/patches/also_check_sudo_group.diff: upstream.

 -- Timo Aaltonen <email address hidden> Sat, 14 Jan 2017 01:41:17 +0200

Thanks for uploading the fix for this bug report to -proposed. However, when reviewing the package in -proposed and the details of this bug report I noticed that the bug description is missing information required for the SRU process. You can find full details at http://wiki.ubuntu.com/StableReleaseUpdates#Procedure but essentially this bug is missing some of the following: a statement of impact, a test case and details regarding the regression potential. Thanks in advance!

Hello Florian, or anyone else affected,

Accepted sudo into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/sudo/1.8.16-0ubuntu1.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Can confirm that it works, just pulled it on our machines.

Hello Florian, or anyone else affected,

Accepted sudo into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/sudo/1.8.16-0ubuntu3.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Sorry, cannot confirm on yakkety since we do not deploy there yet.

This bug was fixed in the package sudo - 1.8.16-0ubuntu1.3

---------------
sudo (1.8.16-0ubuntu1.3) xenial; urgency=medium

  * sssd-doesnt-handle-netgroups.diff, sssd-fix-matching-loop.diff:
    Only check username as part of the netgroup when netgroup_tuple is enabled.
    (LP: #1607666)

 -- Timo Aaltonen <email address hidden> Sat, 14 Jan 2017 01:54:21 +0200

As a part of the Stable Release Updates quality process a search for Launchpad bug reports using the version of sudo from yakkety-proposed was performed and bug 1665062 was found. Please investigate this bug report to ensure that a regression will not be created by this SRU. In the event that this is not a regression remove the "verification-failed" tag from this bug report and add the tag "bot-stop-nagging" to bug 1665062 (not this bug). Thanks!

bug 1665062 has guitarpro6 in the logs as well as significant hardware errors (perhaps just failing CD-ROM drive, perhaps hard drive, they were slightly unusual). That's not a happy computer but it looks unrelated to this SRU.

Thanks

As part of https://www.ubuntu.com/usn/usn-3304-1/ , the sudo in yakkety-proposed has been superceded by sudo 1.8.16-0ubuntu3.2 in yakkety-security. Please upload a new version to yakkety-proposed that incorporates the security fix from the update.

Thanks!