Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

Download an image and run it:

 tt tmp/debian-14-genericcloud-amd64-daily-20260226-2400.qcow2

verify that it's possible to use sudo as the "debian" user without a
password.

Then install libsss-sudo:

 # apt update
 # apt install libsss-sudo

...and notice that sudo as the "debian" user says that the user is not
in the sudoers file.

The cause of this is an entry added by the postinst script to the end of
/etc/nsswitch.conf:

  sudoers: sss

Which seems to be caused by libsss-sudo assuming that the entry should
already exist as "sudoers: files" and trying to add "sss" to the end of
it.  This was proposed in base-files but not yet in the distribution
(also after dist-upgrade): https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770825

The base-files version is "14" here, fwiw.

Hello,

We also got this bug reported in Ubuntu [1]. I have a proposed fix [2]
that boils down to:

1. Adding "files" to "libsss-sudo.nss";
2. Doing some postinst scripting to add "files" to /etc/nsswitch if "sss" is present.

(1) fixes new installations, and (2) fixes the upgrade from a broken
version. I have also attached the patch here.

Does this sound reasonable, or am I missing something?

Thanks,

Forgot to add links to my previous message.

[1]: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/2151950
[2]: https://code.launchpad.net/~puida/ubuntu/+source/sssd/+git/sssd/+merge/506096

Cheers,

Hi Gioele, hi all,

ping via BTS @ dh-nss maintainer, cross-posting to the other related
bugs affected by this, to keep other people in the loop.

People start asking about when sssd is fixed (because autofs is also
impacted by sssd not being in testing).

For the background story and how this all is related:

   * autofs is not in testing, because sssd is not in testing
   * sssd is not in testing because of #1129522
   * to get sssd fixed (#1129522) it needs sudo bug #1147179 getting fixed
   * to get the approach suggested in #1147179 fully functional dh-nss needs
     love (#1148069)
   * this also impact the Debian Edu 14 development, but this is not so
     pressing at the moment, because we are still busy with fine-polishing
     the Debian Edu 13 release

@Gioele (dh-nss maintainer): let me know if there is anything we can
do to speed up the upcoming dh-nss release. Thanks.

Cheers,
Mike

Control: tags 1148069 - patch
simple fix like the one proposed here does not properly cover all the
possible upgrade paths (for arbitrary changes to .nss files). Upgrades
are hard.

I'll try now a different strategy: making the maintscript snippets go
back to a clean state before each upgrade. On paper it works, but I'm
afraid it may cause intermittent issues because there will be a window
of time in which the service will not be enabled in /etc/nsswitch.conf.
In case of a failed upgrade that window may be arbitrarily long and if
that service is something needed to log in, the admin may end up locked
out of their accounts.

Another option, more in line with what sssd and autofs need at the
moment, would be to state something along the lines of ".nss files can
only be added to or removed from a package; changing the content of .nss
files between package versions is not allowed without additional ad-hoc
code in maintscripts".

Both options are unsatisfactory. Option 2 is perhaps the best to unblock
the current sssd situation.

I'll do some other testing and play with these two options during the
weekend, then release a version that will at least unblock sssd.

Ideas and comments are welcome!

Hi Gioele,

Thanks for the info update and for providing a fix to unblock sssd.

Mike

Hi Mike,

On Fri, 02 Oct 2026 15:58:00 +0000 Mike Gabriel <sunweaver@debian.org> wrote:
matches the reality, can you please confirm my reading of the solution
you agreed upon in the other bugs?

 From <https://bugs.debian.org/1147179#30>:

## sudo

sudoers database-add
sudoers first  files

## libsss-sudo

Pre-Depends: sudo (>= $some-version)

sudoers database-require
sudoers after=files  sss

Regards,

Hi Gioele,

Confirming! That's the proposed solution, indeed.

Mike

Hi, I have uploaded dh-nss v1.8~exp2 to experimental. The new code
should fix the issue that affect sssd and sudo (although many other
problems are still lurking.)

Please test. I'll wait for your feedback before uploading v1.8 to unstable.

Regards,