It was reported [1] that SSSD improperly expanded group membership when it encountered a non-POSIX group in the group membership chain. For instance:

user -> posixgroup1 -> nonposixgroup -> posixgroup2

With the group memberships noted above, SSSD should include the user as a member of both posixgroup1 and posixgroup2, however due to the position of the non-POSIX group, SSSD halts processing at it and never reaches posixgroup2, leaving the user as a member of posixgroup1 and not posixgroup2.

SSSD has the capability to set a 'deny' ACL for both users and groups, so in a situation like that illustrated above, if posixgroup2 was present in a 'deny' ACL, the user would be granted access because they are not shown as having membership in the denied group. This could grant unintended access to certain users in an environment where non-POSIX groups are used in addition to POSIX groups.

There is currently no patch to correct this issue.

[1] https://lists.fedorahosted.org/pipermail/sssd-devel/2014-May/019495.html

A memory leak was found in the sssdpacplugin (sssdpacplugin.so library), which is distributed with the sssdclient package.

Original report with additional details:

https://fedorahosted.org/sssd/ticket/2803

Patch:

https://fedorahosted.org/sssd/attachment/ticket/2803/0001-Fix-memory-leak-in-sssdpacverify.patch