Merge ~sergiodj/ubuntu/+source/openldap:bug1557157-focal into ubuntu/+source/openldap:ubuntu/focal-devel

[Sergio Durigan Junior]

When using openldap with sasl authentication, the slapd process will communicate with the saslauthd daemon via a socket in {,/var}/run/saslauthd/mux. Unfortunately, this will fail in every Ubuntu release from trusty onwards, because slapd's apparmor profile doesn't contain the necessary directive to allow it to read/write from/to the socket specified above.

This simple change implements the fix to allow the authentication process to happen.

It's possible to test it by doing:

$ lxc launch ubuntu-daily:focal openldap-bugbug1557157-focal
$ lxc shell openldap-bugbug1557157-focal
# apt install slapd sasl2-bin ldap-utils apparmor-utils

(As the domain name, use "example.com").

# sed -i -e 's/^START=.*/START=yes/' /etc/default/saslauthd
# cat > /etc/ldap/sasl2/slapd.conf << __EOF__
mech_list: PLAIN
pwcheck_method: saslauthd
__EOF__
# adduser openldap sasl
# aa-enforce /etc/apparmor.d/usr.sbin.slapd
# systemctl restart slapd.service
# systemctl restart saslauthd.service
# passwd root

(You can choose any password here. You will need to type it when running the next command.)

# ldapsearch -H ldapi:/// -LLL -b 'dc=example,dc=com' -s base -U root -Y PLAIN

If you are using the fixed package, you will see something like:

SASL username: root
SASL SSF: 0
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: example
dc: example

There is a PPA here: https://launchpad.net/~sergiodj/+archive/ubuntu/openldap-bug1557157

autopkgtest is still happy:

autopkgtest [11:05:28]: test slapd: -----------------------]
autopkgtest [11:05:29]: test slapd: - - - - - - - - - - results - - - - - - - - - -
slapd PASS (superficial)
autopkgtest [11:05:30]: @@@@@@@@@@@@@@@@@@@@ summary
slapd PASS (superficial)

[Christian Ehrhardt  (paelzer)]

Change itself LGTM, is is small simple and reasonable.

review: Approve

[Christian Ehrhardt  (paelzer)]

This was reviewed but not yet uploaded, should be combined with the SRU for bug 1866303

[Andreas Hasenack (ahasenack)]

I will pull this in

[Andreas Hasenack (ahasenack)]

Bug #1866303 doesn't affect focal, so this MP here can be used as is. I'll sponsor it now.

[Andreas Hasenack (ahasenack)]

Tagging and uploading bf0d631a62c756fbdd262f73d4ed95672cf55493

$ git push pkg upload/2.4.49+dfsg-2ubuntu1.3
Enumerating objects: 18003, done.
Counting objects: 100% (18003/18003), done.
Delta compression using up to 4 threads
Compressing objects: 100% (2885/2885), done.
Writing objects: 100% (18003/18003), 8.47 MiB | 250.00 KiB/s, done.
Total 18003 (delta 15239), reused 17163 (delta 15032)
remote: Resolving deltas: 100% (15239/15239), done.
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/openldap
 * [new tag] upload/2.4.49+dfsg-2ubuntu1.3 -> upload/2.4.49+dfsg-2ubuntu1.3

$ dput ubuntu ../openldap_2.4.49+dfsg-2ubuntu1.3_source.changes
Checking signature on .changes
gpg: ../openldap_2.4.49+dfsg-2ubuntu1.3_source.changes: Valid signature from AC983EB5BF6BCBA9
Checking signature on .dsc
gpg: ../openldap_2.4.49+dfsg-2ubuntu1.3.dsc: Valid signature from AC983EB5BF6BCBA9
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openldap_2.4.49+dfsg-2ubuntu1.3.dsc: done.
  Uploading openldap_2.4.49+dfsg-2ubuntu1.3.debian.tar.xz: done.
  Uploading openldap_2.4.49+dfsg-2ubuntu1.3_source.buildinfo: done.
  Uploading openldap_2.4.49+dfsg-2ubuntu1.3_source.changes: done.
Successfully uploaded packages.

[Andreas Hasenack (ahasenack)]

This was released into updates already.

diff --git a/debian/apparmor-profile b/debian/apparmor-profile
index 793fa7b..9e1070f 100644
--- a/debian/apparmor-profile
+++ b/debian/apparmor-profile
@@ -1,5 +1,5 @@
 # vim:syntax=apparmor
-# Last Modified: Fri Jan  4 15:18:13 2008
+# Last Modified: Fri Jun  6 13:51:00 2020
 # Author: Jamie Strandboge <[e-mail]>
 
 #include <tunables/global>
@@ -49,6 +49,7 @@
   /{,var/}run/slapd/* w,
   /{,var/}run/slapd/ldapi rw,
   /{,var/}run/nslcd/socket rw,
+  /{,var/}run/saslauthd/mux rw,
 
   /usr/lib/ldap/ r,
   /usr/lib/ldap/* mr,
diff --git a/debian/changelog b/debian/changelog
index 3007b6b..6cc5f88 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openldap (2.4.49+dfsg-2ubuntu1.3) focal; urgency=medium
+
+  * d/apparmor-profile: Update apparmor profile to grant access to
+    the saslauthd socket, so that SASL authentication works.  (LP: #1557157)
+
+ -- Sergio Durigan Junior <[e-mail]>  Fri, 12 Jun 2020 18:18:58 -0400
+
 openldap (2.4.49+dfsg-2ubuntu1.2) focal-security; urgency=medium
 
   * SECURITY UPDATE: denial of service via nested search filters