IJ31131: GETGRGID DOESN'T WORK WITH DOMAINLESS GROUPS - AFFECTS SUDO APPLIES TO AIX 7200-05

APAR status

• Closed as program error.

Error description

• The getgrgid/getgrgid_r functions do not support
  domainlessgroups. If the calling application first
  makes a call to setauthdb("LDAP"), for example,
  getgrgid will only find LDAP-defined groups. It will
  not be able to find any group in the user's group set
  that is defined locally.
  
  This is known to affect recent versions of sudo. If an
  LDAP user belongs to a local group - and that local
  group is what is used to give this user sudo
  permissions - their sudo permisisons will not be granted.
  

Local fix

Problem summary

• The getgrgid/getgrgid_r functions do not support
  domainlessgroups. If the calling application first
  makes a call to setauthdb("LDAP"), for example,
  getgrgid will only find LDAP-defined groups. It will
  not be able to find any group in the user's group set
  that is defined locally.
  
  This is known to affect recent versions of sudo. If an
  LDAP user belongs to a local group - and that local
  group is what is used to give this user sudo
  permissions - their sudo permisisons will not be granted.
  

Problem conclusion

• The getgrgid/getgrgid_r functions now consider domainless
  groups even if the calling function has set the auth db.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  IJ32836 IJ32840 IJ34997 IJ35379

Fix information

• Fixed component name

  AIX V7.2

• Fixed component ID

  5765CD200

Applicable component levels