Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing user and group information for domain users #129

Open
gentooise opened this issue Apr 24, 2024 · 1 comment
Open

Missing user and group information for domain users #129

gentooise opened this issue Apr 24, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@gentooise
Copy link

Indicate project
libsysflow

Describe the bug
The user name is not reported for domain users.

To reproduce
Steps to reproduce the behavior (on a Ubuntu 22):

  1. Setup LDAP (used local IP as LDAP server name): https://ubuntu.com/server/docs/install-and-configure-ldap
  2. Enable TLS (required by SSSD): https://ubuntu.com/server/docs/ldap-and-transport-layer-security-tls
  3. Setup SSSD with LDAP: https://ubuntu.com/server/docs/how-to-set-up-sssd-with-ldap
  4. Login with newly created LDAP user and run commands (e.g. whoami, ls)

Expected behavior
Events are reported with the correct user name and group, like

Environment (please complete the following information):

  • OS: Ubuntu 22.04, 5.15.0-69-generic
  • SysFlow version: 0.6.3

Additional context
getpwuid and getgrgid standard C functions might be used to retrieve user/group information from uid/gid:

Files

****************************************************************
Header: Exporter , IP , File name 
Process: PID 103194 Creation Time, 1713946076546863602, Exe /usr/bin/whoami, Exe Args , User Name <NA>, Group Name <NA>, TTY 1
Proc Evt: TID 103194, OpFlags 2, Ret 0
****************************************************************
****************************************************************
Header: Exporter , IP , File name 
Process: PID 103195 Creation Time, 1713946077821078567, Exe /usr/bin/ls, Exe Args --color=auto, User Name <NA>, Group Name <NA>, TTY 1
Proc Evt: TID 103195, OpFlags 2, Ret 0
****************************************************************
@gentooise gentooise added the bug Something isn't working label Apr 24, 2024
@gentooise
Copy link
Author

gentooise commented May 13, 2024

After analysis and workaround implementation on consumer side, I would like to share a piece of information if you plan to resolve this. The musl implementation of getpwuid differs from glibc and cannot be used to resolve the issue as I initially thought.

musl specifically does not use nss itself because it's not compatible with static linking and because loading arbitrary module libraries into the calling process's core is not safe and goes against best practices.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant