sssd-devel August 2015

sssd-devel@lists.fedorahosted.org

15 participants
68 discussions

Start a nNew thread

[PATCH] p11child: set restrictive umask and clear environment
by Jakub Hrozek 17 Aug '15

17 Aug '15

Hi, the attached patch hardens the p11_child process.

2 4

[WIP] [TEST]: Observation patch
by Petr Cech 17 Aug '15

17 Aug '15

Hi, I have explored in detail why the test responder_cache_req-tests failed so often. I created a new VM with RHEL 6.7. OBSERVATION: How we know, CI machines are under pressure, so I wrote simple cpu_braker, see [1]. I ran the tests 50 times with cpu_braker (average load > 2.60, only 1 CPU). Results: [ RUN ] test_users_by_filter_multiple_domains_valid 0x2 != 0 src/tests/cmocka/test_responder_cache_req.c:1875: error: Failure! [ RUN ] test_users_by_filter_multiple_domains_valid 0x1 != 0x2 src/tests/cmocka/test_responder_cache_req.c:1879: error: Failure! [ RUN ] test_groups_by_filter_valid 0x1 != 0x2 src/tests/cmocka/test_responder_cache_req.c:1972: error: Failure! [ RUN ] test_groups_by_filter_multiple_domains_valid 0x2 != 0 src/tests/cmocka/test_responder_cache_req.c:2051: error: Failure! [ RUN ] test_groups_by_filter_multiple_domains_valid 0x1 != 0x2 src/tests/cmocka/test_responder_cache_req.c:2055: error: Failure! These errors say they failed to retrieve data from the cache. Tests inserts two test values into the cache at the beginning of their run, and then tries to pull it back. And sometime if they are under pressure, they fail. For a more detailed explanation, I added some printf(). I ran the test 25 times. The results: [ RUN ] test_users_by_filter_valid >>> ... sysdb_store_user at [1439384336] (src/db/sysdb_ops.c:1882) >>> ... cache_req_input_create at [1439384337] (src/responder/common/responder_cache_req.c:122) >>> ... recent_filter = [(lastUpdate>=1439384337)] (src/responder/common/responder_cache_req.c:44) >>> ... sysdb_store_user at [1439384337] (src/db/sysdb_ops.c:1882) >>> ... recent_filter = [(lastUpdate>=1439384337)] (src/responder/common/responder_cache_req.c:44) 0x1 != 0x2 src/tests/cmocka/test_responder_cache_req.c:1748: error: Failure! [ RUN ] test_users_by_filter_multiple_domains_valid >>> ... sysdb_store_user at [1439384174] (src/db/sysdb_ops.c:1882) >>> ... sysdb_store_user at [1439384174] (src/db/sysdb_ops.c:1882) >>> ... cache_req_input_create at [1439384175] (src/responder/common/responder_cache_req.c:122) >>> ... recent_filter = [(lastUpdate>=1439384175)] (src/responder/common/responder_cache_req.c:44) >>> ... recent_filter = [(lastUpdate>=1439384175)] (src/responder/common/responder_cache_req.c:44) 0x2 != 0 src/tests/cmocka/test_responder_cache_req.c:1874: error: Failure! [ RUN ] test_groups_by_filter_valid >>> ... sysdb_store_group at [1439385276] (src/db/sysdb_ops.c:2042) >>> ... cache_req_input_create at [1439385277] (src/responder/common/responder_cache_req.c:122) >>> ... recent_filter = [(lastUpdate>=1439385277)] (src/responder/common/responder_cache_req.c:67) >>> ... sysdb_store_group at [1439385277] (src/db/sysdb_ops.c:2042) >>> ... recent_filter = [(lastUpdate>=1439385277)] (src/responder/common/responder_cache_req.c:67) 0x1 != 0x2 src/tests/cmocka/test_responder_cache_req.c:1971: error: Failure! [ RUN ] test_groups_by_filter_multiple_domains_valid >>> ... sysdb_store_group at [1439385286] (src/db/sysdb_ops.c:2042) >>> ... sysdb_store_group at [1439385287] (src/db/sysdb_ops.c:2042) >>> ... cache_req_input_create at [1439385287] (src/responder/common/responder_cache_req.c:122) >>> ... recent_filter = [(lastUpdate>=1439385287)] (src/responder/common/responder_cache_req.c:67) >>> ... recent_filter = [(lastUpdate>=1439385287)] (src/responder/common/responder_cache_req.c:67) 0x1 != 0x2 src/tests/cmocka/test_responder_cache_req.c:2054: error: Failure! As we can see, we have discovered a new failing test test_users_by_filter_valid. REPRODUCER: Use cpu_braker [1] and observation patch [2] and try some iterations... # for i in {1..50} ; do ./responder_cache_req-tests ; done SOLUTION? The problem is caused by trying to retrieve records from the cache, with the time filter set. A time filter we have set by the time of the request creation. However, we create the request in our tests after inserting records into the cache. Therefore, it may vary the data records time and the time filter. So, solution is create the request and then insert records or create request and set: # req.req_start = req.req_start - 1. Please, can you help me? For example see function: test_users_by_filter_multiple_domains_valid() in src/tests/cmocka/test_responder_cache_req.c:1834 Regards Petr ATTACHMENTS: [1] cpu_braker.c [2] 0001-TEST-Observation-patch.patch

2 6

[PATCH] Fetch one-way trust keytabs on sssd restart again
by Jakub Hrozek 14 Aug '15

14 Aug '15

Hi, the attached patches implement fetching the keytab for one-way trusts on each sssd restart. This is in order for admin to be able to call service sssd restart and have fresh keytabs in case the trust was re-established in the meantime. Even though retrieving the keytabs is quite expensive operation, restarting the sssd instance on the IPA server should be quite rare.

2 5

IFP: use default limit if provided is 0
by Pavel Březina 14 Aug '15

14 Aug '15

3 2

[PATCH] DEBUG: Add new debug category for fail over
by Michal Židek 14 Aug '15

14 Aug '15

See attached patch that adds debug messages Michal

4 10

[PATCH] SYSDB: add more debug msgs. to group membership code
by Pavel Reichl 13 Aug '15

13 Aug '15

Hello, I'm investigating log file with debug_level 9 that contains following lines > [sssd[be[dom]]] [sysdb_update_members_ex] (0x0020): Could not add > member [user@dom] to group [somedn]. Skipping. > [sssd[be[dom]]] [sysdb_update_members_ex] (0x0020): Could not add > member [user@dom] to group [somedn2]. Skipping. > [sssd[be[dom]]] [sysdb_update_members_ex] (0x0020): Could not add > member [user@dom] to group [somedn3]. Skipping. It's hard to see what went wrong. Attached patch should add more information.

3 8

[PATCH] krb5_utils-tests: Remove unused variables
by Lukas Slebodnik 10 Aug '15

10 Aug '15

ehlo, there was a warning/error src/tests/krb5_utils-tests.c: In function ‘test_sss_krb5_realm_has_proxy’: src/tests/krb5_utils-tests.c:690:10: error: unused variable ‘perr’ [-Werror=unused-variable] long perr; ^ src/tests/krb5_utils-tests.c:689:21: error: unused variable ‘kerr’ [-Werror=unused-variable] krb5_error_code kerr; ^ cc1: all warnings being treated as errors LS

3 6

[PATCH] IPA: Improve some failure messages
by Pavel Reichl 07 Aug '15

07 Aug '15

Hello, while investigating logs from customer I noticed a few failure messages missing textual description of error return value and some messages were missing even the number of error. Please see trivial patch attached. Thanks!

3 6

[PATCHES] KDC proxy related fixes
by Sumit Bose 07 Aug '15

07 Aug '15

Hi, it turned out that some of the current SSSD behaviour does not fit well if a KDC proxy is configured, see https://fedorahosted.org/sssd/ticket/2652 and https://fedorahosted.org/sssd/ticket/2700 for details. The first patch in this series introduces a new call which checks if a KDC proxy is configured as suggested in the tickets. The other two patches aim to fix the respective ticket. bye, Sumit

5 9

[PATCH] SPEC: Workaround for build with rpm 4.13
by Lukas Slebodnik 05 Aug '15

05 Aug '15

ehlo, patch is attached. LS

2 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

sssd-devel August 2015