On (17/08/15 14:45), Michal Židek wrote:
On 08/17/2015 01:22 PM, Lukas Slebodnik wrote:
>On (14/08/15 14:40), Michal Židek wrote:
>>Hi,
>>
>>this patch is a hotfix for pam-srv-failing
>>tests.
>>
>>Increasing the timeout to 30 seconds seems
>>to be enough. I do not want to make it too
>>big because the timeout is currently not
>>configurable.
>>
>The observation seems to be correct; at least according to log file
>http://sssd-ci.duckdns.org/logs/job/23/21/rhel7/ci-build-debug/pam-srv-tests.log
>
>There is a 3.5 seconds delays between creating child handler and 1st message in
>child.
>(Mon Aug 17 10:50:35:304490 2015) [sssd] [child_handler_setup] (0x2000): Setting up
signal handler up for pid [30764]
>(Mon Aug 17 10:50:35:305471 2015) [sssd] [child_handler_setup] (0x2000): Signal
handler set up for pid [30764]
>(Mon Aug 17 10:50:35:306615 2015) [sssd] [pam_initgr_cache_remove] (0x2000): [pamuser]
removed from PAM initgroup cache
>(Mon Aug 17 10:50:35:307109 2015) [sssd] [pam_initgr_cache_remove] (0x2000):
[wronguser] removed from PAM initgroup cache
>(Mon Aug 17 10:50:38:972629 2015) [[sssd[p11_child[30764]]]] [main] (0x0400):
p11_child started.
>
>
>And another 5 seconds between starting real work in the child
>(Mon Aug 17 10:50:39:091652 2015) [[sssd[p11_child[30764]]]] [main] (0x0020): setuid
failed: 1, p11_child might not work!
>(Mon Aug 17 10:50:39:093917 2015) [[sssd[p11_child[30764]]]] [main] (0x0020): setgid
failed: 1, p11_child might not work!
>(Mon Aug 17 10:50:39:094746 2015) [[sssd[p11_child[30764]]]] [main] (0x2000): Running
with real IDs [499][499].
>(Mon Aug 17 10:50:44:375594 2015) [[sssd[p11_child[30764]]]] [do_work] (0x4000):
Default Module List:
>
>It might be caused either by valgrind or by high load on machine.
>IMHO changing default from 10 seconds to 30 is too much.
>
>We can use the same trick in dyndns_test
>dyndns_tests_CFLAGS = \
> $(AM_CFLAGS) \
> -DDYNDNS_TIMEOUT=2
>
>and in pamsrv_cmd.c use conditional default value.
>#ifndef SSS_P11_CHILD_TIMEOUT
># define SSS_P11_CHILD_TIMEOUT 30
>#endif
>
>
>
>>I'd like to talk to Sumit about what he thinks
>>the proper solution should be. I am not sure
>>if it times out because we do something
>>unnecessary in p11 child.
>>
>>See the simple patch.
>>
>LS
Thank you for comments. I pushed the newly attached
patch to CI (5 times, essential tests only, with
disabled be_req tests). To see if it fails. I
am waiting for the results now.
I'm definitelly sure it will work.
I tested first version with hardcoded 30 seconds
and it passed more then 25 runs :-)
BTW it would be good to find out what is a reason
so big (3-5 seconds) timeouts.
From 9b218d50bcfb31bbb8167ea9b02711de9a6de14b Mon Sep 17 00:00:00
2001
From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek(a)redhat.com>
Date: Thu, 13 Aug 2015 14:03:24 +0200
Subject: [PATCH] pam: Incerease p11 child timeout
Ticket:
https://fedorahosted.org/sssd/ticket/2746
It was timeouting often in CI machines.
---
ACK
LS