Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

Download an image and run it:

 tt tmp/debian-14-genericcloud-amd64-daily-20260226-2400.qcow2

verify that it's possible to use sudo as the "debian" user without a
password.

Then install libsss-sudo:

 # apt update
 # apt install libsss-sudo

...and notice that sudo as the "debian" user says that the user is not
in the sudoers file.

The cause of this is an entry added by the postinst script to the end of
/etc/nsswitch.conf:

  sudoers: sss

Which seems to be caused by libsss-sudo assuming that the entry should
already exist as "sudoers: files" and trying to add "sss" to the end of
it.  This was proposed in base-files but not yet in the distribution
(also after dist-upgrade): https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770825

The base-files version is "14" here, fwiw.

Hello,

We also got this bug reported in Ubuntu [1]. I have a proposed fix [2]
that boils down to:

1. Adding "files" to "libsss-sudo.nss";
2. Doing some postinst scripting to add "files" to /etc/nsswitch if "sss" is present.

(1) fixes new installations, and (2) fixes the upgrade from a broken
version. I have also attached the patch here.

Does this sound reasonable, or am I missing something?

Thanks,

Forgot to add links to my previous message.

[1]: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/2151950
[2]: https://code.launchpad.net/~puida/ubuntu/+source/sssd/+git/sssd/+merge/506096

Cheers,

Hi Gioele, hi all,

ping via BTS @ dh-nss maintainer, cross-posting to the other related
bugs affected by this, to keep other people in the loop.

People start asking about when sssd is fixed (because autofs is also
impacted by sssd not being in testing).

For the background story and how this all is related:

   * autofs is not in testing, because sssd is not in testing
   * sssd is not in testing because of #1129522
   * to get sssd fixed (#1129522) it needs sudo bug #1147179 getting fixed
   * to get the approach suggested in #1147179 fully functional dh-nss needs
     love (#1148069)
   * this also impact the Debian Edu 14 development, but this is not so
     pressing at the moment, because we are still busy with fine-polishing
     the Debian Edu 13 release

@Gioele (dh-nss maintainer): let me know if there is anything we can
do to speed up the upcoming dh-nss release. Thanks.

Cheers,
Mike

Control: tags 1148069 - patch
simple fix like the one proposed here does not properly cover all the
possible upgrade paths (for arbitrary changes to .nss files). Upgrades
are hard.

I'll try now a different strategy: making the maintscript snippets go
back to a clean state before each upgrade. On paper it works, but I'm
afraid it may cause intermittent issues because there will be a window
of time in which the service will not be enabled in /etc/nsswitch.conf.
In case of a failed upgrade that window may be arbitrarily long and if
that service is something needed to log in, the admin may end up locked
out of their accounts.

Another option, more in line with what sssd and autofs need at the
moment, would be to state something along the lines of ".nss files can
only be added to or removed from a package; changing the content of .nss
files between package versions is not allowed without additional ad-hoc
code in maintscripts".

Both options are unsatisfactory. Option 2 is perhaps the best to unblock
the current sssd situation.

I'll do some other testing and play with these two options during the
weekend, then release a version that will at least unblock sssd.

Ideas and comments are welcome!

Hi Gioele,

Thanks for the info update and for providing a fix to unblock sssd.

Mike

Hi Mike,

On Fri, 02 Oct 2026 15:58:00 +0000 Mike Gabriel <sunweaver@debian.org> wrote:
matches the reality, can you please confirm my reading of the solution
you agreed upon in the other bugs?

 From <https://bugs.debian.org/1147179#30>:

## sudo

sudoers database-add
sudoers first  files

## libsss-sudo

Pre-Depends: sudo (>= $some-version)

sudoers database-require
sudoers after=files  sss

Regards,

Hi Gioele,

Confirming! That's the proposed solution, indeed.

Mike

Hi, I have uploaded dh-nss v1.8~exp2 to experimental. The new code
should fix the issue that affect sssd and sudo (although many other
problems are still lurking.)

Please test. I'll wait for your feedback before uploading v1.8 to unstable.

Regards,

Do you need that change in an experimental sudo upload?

Greetings
Marc

Hi Marc,

For my testing, this is not needed. I am currently down with a cold,
so not sure when I will get to testing this. (Not longer than
beginning of next week, I hope).

Mike

Hi Gioele, hi Marc,

I think we are good to go with dh-nss v1.8.

I ran various installation and upgrade tests now and v1.8 seems stable
enough to cover all upgrade/installation pathways I have tested:

   * [x] neither sudo, nor libsss-sudo installed; install my sudo,
nsswitch.conf: sudoers: files
   * [x] neither sudo, nor libsss-sudo installed; install both of my
package versions, nsswitch.conf: sudoers: files sss
   * [x] sudo installed, upgrade to new sudo version with sudo.nss
included, nsswitch.conf: sudoers: files
   * [x] sudo installed, manual change of nsswitch.conf: sudoers:
ldap, install new sudo version, nsswitch.conf: sudoers: files ldap
   * [x] sudo installed, manual change of nsswitch.conf: sudoers:
ldap, install new sudo and new libsss-sudo version, nsswitch.conf:
sudoers: files ldap sss
         (note, that I'll probably go with "sudoers last	sss" in
libsss-sudo.nss)
   * [x] sudo installed, libsss-sudo installed, upgrade to my local
pkg versions, nsswitch.conf: sudoers: files sss
   * etc. (I guess I tested some more, but did not write them all down)

The .debdiffs I used:


sudo:

```
locadm@libsss-sudo-1129522:~$ debdiff sudo_1.9.17p2-9.dsc
sudo_1.9.17p2-9.1.dsc
diff -Nru sudo-1.9.17p2/debian/changelog sudo-1.9.17p2/debian/changelog
--- sudo-1.9.17p2/debian/changelog	2026-09-28 12:40:42.000000000 +0000
+++ sudo-1.9.17p2/debian/changelog	2026-10-09 05:39:58.000000000 +0000
@@ -1,3 +1,10 @@
+sudo (1.9.17p2-9.1) UNRELEASED; urgency=medium
+
+  * debian/sudo.nss:
+    + Authoritatively manage sudoers: entry in nsswitch.conf.
+
+ --  <sunweaver@debian.org>  Fri, 09 Oct 2026 05:39:58 +0000
+
  sudo (1.9.17p2-9) unstable; urgency=medium

    * Apply upstream patches to address CVE-2026-96512.
diff -Nru sudo-1.9.17p2/debian/control sudo-1.9.17p2/debian/control
--- sudo-1.9.17p2/debian/control	2026-09-28 12:40:42.000000000 +0000
+++ sudo-1.9.17p2/debian/control	2026-10-09 05:39:58.000000000 +0000
@@ -10,6 +10,7 @@
  Build-Depends:
   debhelper-compat (= 13),
   dh-sequence-installnss,
+ dh-nss (>= 1.8~),
  Build-Depends-Arch:
   autoconf,
   bison,
diff -Nru sudo-1.9.17p2/debian/sudo.nss sudo-1.9.17p2/debian/sudo.nss
--- sudo-1.9.17p2/debian/sudo.nss	1970-01-01 00:00:00.000000000 +0000
+++ sudo-1.9.17p2/debian/sudo.nss	2026-09-09 20:34:35.000000000 +0000
@@ -0,0 +1,3 @@
+sudoers database-add
+
+sudoers first           files
```

sssd:

```
locadm@libsss-sudo-1129522:~$ debdiff sssd_2.13.1-3.dsc sssd_2.13.1-3.1.dsc
diff -Nru sssd-2.13.1/debian/changelog sssd-2.13.1/debian/changelog
--- sssd-2.13.1/debian/changelog	2026-09-08 11:05:35.000000000 +0000
+++ sssd-2.13.1/debian/changelog	2026-10-09 04:20:16.000000000 +0000
@@ -1,3 +1,15 @@
+sssd (2.13.1-3.1) UNRELEASED; urgency=medium
+
+  * Rebuild against dh-nss 1.8~.
+  * debian/libsss-sudo:
+    + Adjust rules, expect sudo bin:pkg to own the sudoers: entry in
+      nsswitch.conf.
+  * debian/patches:
+    + Add gdm-51-pam-extension-macros-compat.patch. Fix building against
+      libgdm-dev (>= 51).
+
+ --  <sunweaver@debian.org>  Fri, 09 Oct 2026 04:20:16 +0000
+
  sssd (2.13.1-3) unstable; urgency=medium

    * debian/tests/control: Explicitly have tests requiring
openssh-client depend
diff -Nru sssd-2.13.1/debian/control sssd-2.13.1/debian/control
--- sssd-2.13.1/debian/control	2026-09-08 11:05:33.000000000 +0000
+++ sssd-2.13.1/debian/control	2026-10-09 04:20:16.000000000 +0000
@@ -12,6 +12,7 @@
   dh-apparmor,
   dh-python,
   dh-sequence-installnss,
+ dh-nss (>= 1.8~),
   bind9-dnsutils,
   docbook-xml,
   docbook-xsl,
@@ -372,6 +373,7 @@
  Package: libsss-sudo
  Section: libs
  Architecture: any
+Pre-Depends: ${misc:Pre-Depends}, sudo (>= 1.9.17p2-9.1~)
  Depends: ${misc:Depends}, ${shlibs:Depends}
  Description: Communicator library for sudo
   Utility library to allow communication between sudo and SSSD for caching
diff -Nru sssd-2.13.1/debian/libsss-sudo.nss
sssd-2.13.1/debian/libsss-sudo.nss
--- sssd-2.13.1/debian/libsss-sudo.nss	2026-09-08 11:05:33.000000000 +0000
+++ sssd-2.13.1/debian/libsss-sudo.nss	2026-10-09 04:20:16.000000000 +0000
@@ -1,3 +1,3 @@
-sudoers	database-add
+sudoers	database-require

  sudoers last	sss
diff -Nru
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch
---  
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch	1970-01-01
00:00:00.000000000 +0000
+++
sssd-2.13.1/debian/patches/gdm-51-pam-extension-macros-compat.patch	2026-10-09
04:20:16.000000000 +0000
@@ -0,0 +1,54 @@
+Description: Fix FTBFS with GDM 51 PAM extension headers
+ GDM 51 rewrote its gdm-pam-extensions headers, replacing the uppercase
+ function-like macros with static inline functions.
+Author: Renan Rodrigo <rr@ubuntu.com>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/2163336
+Forwarded: https://github.com/SSSD/sssd/pull/9076
+Last-Update: 2026-08-12
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+Index: sssd-2.13.1/src/sss_client/pam_sss.c
+===================================================================
+--- sssd-2.13.1.orig/src/sss_client/pam_sss.c
++++ sssd-2.13.1/src/sss_client/pam_sss.c
+@@ -67,6 +67,40 @@
+ #endif
+ #endif /* HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION */
+
++/* GDM 51 replaced the uppercase function-like macros of its PAM extension
++ * headers with lowercase static inline functions. Provide the old macro
++ * names as aliases so the code below keeps compiling with both old and new
++ * gdm-pam-extensions. */
++#ifdef HAVE_GDM_PAM_EXTENSIONS
++#ifndef GDM_PAM_EXTENSION_SUPPORTED
++#define GDM_PAM_EXTENSION_SUPPORTED(name) \
++    gdm_pam_extension_supported(name)
++#endif
++#ifndef GDM_PAM_EXTENSION_MESSAGE_TO_BINARY_PROMPT_MESSAGE
++#define
GDM_PAM_EXTENSION_MESSAGE_TO_BINARY_PROMPT_MESSAGE(extended_message,
binary_message) \
++
gdm_pam_extension_message_to_binary_prompt_message((GdmPamExtensionMessage
*)(extended_message), binary_message)
++#endif
++#ifndef GDM_PAM_EXTENSION_CHOICE_LIST_REQUEST_INIT
++#define GDM_PAM_EXTENSION_CHOICE_LIST_REQUEST_INIT(request, title,
num_items) \
++    gdm_pam_extension_choice_list_request_init(request, title, num_items)
++#endif
++#ifndef GDM_PAM_EXTENSION_REPLY_TO_CHOICE_LIST_RESPONSE
++#define GDM_PAM_EXTENSION_REPLY_TO_CHOICE_LIST_RESPONSE(reply) \
++    gdm_pam_extension_reply_to_choice_list_response(reply)
++#endif
++#endif /* HAVE_GDM_PAM_EXTENSIONS */
++
++#ifdef HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION
++#ifndef GDM_PAM_EXTENSION_CUSTOM_JSON_REQUEST_INIT
++#define GDM_PAM_EXTENSION_CUSTOM_JSON_REQUEST_INIT(request,
proto_name, proto_version, json_str) \
++    gdm_pam_extension_custom_json_request_init(request, proto_name,
proto_version, json_str)
++#endif
++#ifndef GDM_PAM_EXTENSION_REPLY_TO_CUSTOM_JSON_RESPONSE
++#define GDM_PAM_EXTENSION_REPLY_TO_CUSTOM_JSON_RESPONSE(reply) \
++    gdm_pam_extension_reply_to_custom_json_response(reply)
++#endif
++#endif /* HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION */
++
+ #include "sss_pam_compat.h"
+ #include "sss_pam_macros.h"
+
diff -Nru sssd-2.13.1/debian/patches/series sssd-2.13.1/debian/patches/series
--- sssd-2.13.1/debian/patches/series	2026-09-08 11:05:33.000000000 +0000
+++ sssd-2.13.1/debian/patches/series	2026-10-09 04:20:16.000000000 +0000
@@ -9,3 +9,4 @@
  CVE-2026-68742.diff
  CVE-2026-68743.diff
  CVE-2026-68744.diff
+gdm-51-pam-extension-macros-compat.patch

```

Greets,
Mike

Hi Mike,

On Fri, 09 Oct 2026 06:21:06 +0000 Mike Gabriel <sunweaver@debian.org> wrote:

Thanks Mike, also for the initial bug report and patch.

I have released v1.8 with the fix.

Regards,

Hi Gioele, hi Marc,

thanks for the upload, Gioele.

@Marc: Your turn regarding sudo...

Mike

Will do, hopefully later this week. I apologize for being unresponsive.

Greetings
Marc

What exactly am I supposed to do? Which files does sudo have to put
where? I am sorry for having lost context.

Greetings
Marc