Merge ~sergiodj/ubuntu/+source/openldap:bug1557157-xenial into ubuntu/+source/openldap:ubuntu/xenial-devel

[Sergio Durigan Junior]

When using openldap with sasl authentication, the slapd process will communicate with the saslauthd daemon via a socket in {,/var}/run/saslauthd/mux. Unfortunately, this will fail in every Ubuntu release from trusty onwards, because slapd's apparmor profile doesn't contain the necessary directive to allow it to read/write from/to the socket specified above.

This simple change implements the fix to allow the authentication process to happen.

It's possible to test it by doing:

$ lxc launch ubuntu-daily:xenial openldap-bugbug1557157-xenial
$ lxc shell openldap-bugbug1557157-xenial
# apt install slapd sasl2-bin ldap-utils apparmor-utils

(As the domain name, use "example.com").

# sed -i -e 's/^START=.*/START=yes/' /etc/default/saslauthd
# cat > /etc/ldap/sasl2/slapd.conf << __EOF__
mech_list: PLAIN
pwcheck_method: saslauthd
__EOF__
# adduser openldap sasl
# aa-enforce /etc/apparmor.d/usr.sbin.slapd
# systemctl restart slapd.service
# systemctl restart saslauthd.service
# passwd root

(You can choose any password here. You will need to type it when running the next command.)

# ldapsearch -H ldapi:/// -LLL -b 'dc=example,dc=com' -s base -U root -Y PLAIN

If you are using the fixed package, you will see something like:

SASL username: root
SASL SSF: 0
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: example
dc: example

There is a PPA here: https://launchpad.net/~sergiodj/+archive/ubuntu/openldap-bug1557157

autopkgtest is still happy (well, because of a bug, there is no d/tests/control file, so no tests are run):

autopkgtest [12:05:10]: build not needed
* SKIP no tests in this package
autopkgtest [12:05:11]: @@@@@@@@@@@@@@@@@@@@ summary
* SKIP no tests in this package

[Christian Ehrhardt  (paelzer)]

Change itself LGTM, is is small simple and reasonable.

[Christian Ehrhardt  (paelzer)]

review: Approve

[Christian Ehrhardt  (paelzer)]

This was reviewed but not yet uploaded, should be combined with the SRU for bug 1866303

[Andreas Hasenack (ahasenack)]

I will pull this in

[Andreas Hasenack (ahasenack)]

I included it and uploaded together with my fix. I'll leave this MP as is, hoping the importer will close it as soon as the upload is accepted, but if that's not the case, it can be set to "merged" manually at that time.

[Andreas Hasenack (ahasenack)]

This was released into updates already.

diff --git a/debian/apparmor-profile b/debian/apparmor-profile
index 793fa7b..9e1070f 100644
--- a/debian/apparmor-profile
+++ b/debian/apparmor-profile
@@ -1,5 +1,5 @@
 # vim:syntax=apparmor
-# Last Modified: Fri Jan  4 15:18:13 2008
+# Last Modified: Fri Jun  6 13:51:00 2020
 # Author: Jamie Strandboge <[e-mail]>
 
 #include <tunables/global>
@@ -49,6 +49,7 @@
   /{,var/}run/slapd/* w,
   /{,var/}run/slapd/ldapi rw,
   /{,var/}run/nslcd/socket rw,
+  /{,var/}run/saslauthd/mux rw,
 
   /usr/lib/ldap/ r,
   /usr/lib/ldap/* mr,
diff --git a/debian/changelog b/debian/changelog
index 3cbc80b..2e7f729 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+openldap (2.4.42+dfsg-2ubuntu3.9) xenial; urgency=medium
+
+  * d/apparmor-profile: Update apparmor profile to grant access to
+    the saslauthd socket, so that SASL authentication works.  (LP: #1557157)
+
+ -- Sergio Durigan Junior <[e-mail]>  Fri, 12 Jun 2020 18:13:57 -0400
+
 openldap (2.4.42+dfsg-2ubuntu3.8) xenial-security; urgency=medium
 
   * SECURITY UPDATE: denial of service via nested search filters