-
Notifications
You must be signed in to change notification settings - Fork 3
Open
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the Bug
pangolin up with an sssd user on a linux system will not get past the starting phase.
pangolin up
[sudo] password for user:
Starting up client...
Status: Starting
If I switch to a local users I can connect just fine.
some relevant logs (redacted some info)
Feb 14 16:00:18 minisv3 sssd[54573]: exec_child_ex command: [/usr/libexec/sssd/selinux_child] /usr/libexec/sssd/selinux_child --dumpable=1 --debug-microseconds=0 --debug-timestamps=1 --debug-fd=24 --chain-id=303 --backtrace=1 --debug-level=0x2f7f0
Feb 14 16:00:18 minisv3 sudo[54480]: user : TTY=pts/3 ; PWD=/home/user ; USER=root ; COMMAND=/usr/bin/sh -c 'export PANGOLIN_SUBPROCESS=1 && export PANGOLIN_CREDENTIALS_FROM_KEYRING=1 && nohup "/usr/local/bin/pangolin" "up" "client" "--org" "removed" "--id" "removed" "--secret" "removed" "--endpoint" "removed" >/dev/null 2>&1 &'
(2026-02-14 16:00:18): [selinux_child[54573]] [sss_log_process_caps] (0x0100): [RID#303] Starting under ruid=467, euid=467, suid=467 : rgid=467, egid=467, sgid=467
(2026-02-14 16:00:18): [selinux_child[54573]] [sss_log_process_caps] (0x0100): [RID#303] With following capabilities:
CAP_SETGID: effective = 0 , permitted = *1*, inheritable = 0 , bounding = *1*
CAP_SETUID: effective = 0 , permitted = *1*, inheritable = 0 , bounding = *1*
(2026-02-14 16:00:18): [selinux_child[54573]] [main] (0x0400): [RID#303] context initialized
(2026-02-14 16:00:18): [selinux_child[54573]] [unpack_buffer] (0x2000): [RID#303] seuser length: 12
(2026-02-14 16:00:18): [selinux_child[54573]] [unpack_buffer] (0x2000): [RID#303] seuser: unconfined_u
(2026-02-14 16:00:18): [selinux_child[54573]] [unpack_buffer] (0x2000): [RID#303] mls_range length: 14
(2026-02-14 16:00:18): [selinux_child[54573]] [unpack_buffer] (0x2000): [RID#303] mls_range: s0-s0:c0.c1023
(2026-02-14 16:00:18): [selinux_child[54573]] [unpack_buffer] (0x2000): [RID#303] username length: 6
(2026-02-14 16:00:18): [selinux_child[54573]] [unpack_buffer] (0x2000): [RID#303] username: user
(2026-02-14 16:00:18): [selinux_child[54573]] [sss_log_process_caps] (0x0100): [RID#303] Performing selinux operations under ruid=0, euid=0, suid=467 : rgid=0, egid=0, sgid=467
(2026-02-14 16:00:18): [selinux_child[54573]] [sss_log_process_caps] (0x0100): [RID#303] With following capabilities:
(nothing)
(2026-02-14 16:00:18): [selinux_child[54573]] [seuser_needs_update] (0x2000): [RID#303] sss_get_seuser: ret: 0 seuser: unconfined_u mls: s0-s0:c0.c1023
(2026-02-14 16:00:18): [selinux_child[54573]] [sss_seuser_exists] (0x0400): [RID#303] seuser exists: yes
(2026-02-14 16:00:18): [selinux_child[54573]] [seuser_needs_update] (0x0400): [RID#303] The SELinux user does not need an update
(2026-02-14 16:00:18): [selinux_child[54573]] [main] (0x0400): [RID#303] selinux_child completed successfully
Environment
- OS: openSUSE MicroOS 20260212
- Pangolin Version: 1.15.4
- Gerbil Version: 1.3
- Traefik Version: 3.6
- SELinux: enforcing
- SSSD: 2.12
- IPA, version: 4.12.2
To Reproduce
- Login as SSSD user on linux
- pangolin up
Expected Behavior
pangolin up shoud start the connection
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working