[Pkg-sssd-devel] Bug#1129522: libsss-sudo: Can't sudo after installing libsss-sudo (due to broken nsswitch update)

[Allison Karlitskaya]

Package: libsss-sudo
Version: 2.12.0-2
Severity: grave
Justification: renders package unusable

Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

Download an image and run it:

 tt tmp/debian-14-genericcloud-amd64-daily-20260226-2400.qcow2

verify that it's possible to use sudo as the "debian" user without a
password.

Then install libsss-sudo:

 # apt update
 # apt install libsss-sudo

...and notice that sudo as the "debian" user says that the user is not
in the sudoers file.

The cause of this is an entry added by the postinst script to the end of
/etc/nsswitch.conf:

  sudoers: sss

Which seems to be caused by libsss-sudo assuming that the entry should
already exist as "sudoers: files" and trying to add "sss" to the end of
it.  This was proposed in base-files but not yet in the distribution
(also after dist-upgrade): https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770825

The base-files version is "14" here, fwiw.

-- System Information:
Debian Release: forky/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.18.12+deb14-cloud-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libsss-sudo depends on:
ii  libc6  2.42-13

libsss-sudo recommends no packages.

libsss-sudo suggests no packages.

-- no debconf information