Re: [SSSD] [PATCH] pam: Incerease p11 child timeout
On Mon, Aug 17, 2015 at 03:03:35PM +0200, Lukas Slebodnik wrote:
On (17/08/15 14:45), Michal Židek wrote:
>On 08/17/2015 01:22 PM, Lukas Slebodnik wrote:
>>On (14/08/15 14:40), Michal Židek wrote:
>>>Hi,
>>>
>>>this patch is a hotfix for pam-srv-failing
>>>tests.
>>>
>>>Increasing the timeout to 30 seconds seems
>>>to be enough. I do not want to make it too
>>>big because the timeout is currently not
>>>configurable.
>>>
>>The observation seems to be correct; at least according to log file
>>http://sssd-ci.duckdns.org/logs/job/23/21/rhel7/ci-build-debug/pam-srv-tests.log
>>
>>There is a 3.5 seconds delays between creating child handler and 1st message in
>>child.
>>(Mon Aug 17 10:50:35:304490 2015) [sssd] [child_handler_setup] (0x2000): Setting
up signal handler up for pid [30764]
>>(Mon Aug 17 10:50:35:305471 2015) [sssd] [child_handler_setup] (0x2000): Signal
handler set up for pid [30764]
>>(Mon Aug 17 10:50:35:306615 2015) [sssd] [pam_initgr_cache_remove] (0x2000):
[pamuser] removed from PAM initgroup cache
>>(Mon Aug 17 10:50:35:307109 2015) [sssd] [pam_initgr_cache_remove] (0x2000):
[wronguser] removed from PAM initgroup cache
>>(Mon Aug 17 10:50:38:972629 2015) [[sssd[p11_child[30764]]]] [main] (0x0400):
p11_child started.
>>
>>
>>And another 5 seconds between starting real work in the child
>>(Mon Aug 17 10:50:39:091652 2015) [[sssd[p11_child[30764]]]] [main] (0x0020):
setuid failed: 1, p11_child might not work!
>>(Mon Aug 17 10:50:39:093917 2015) [[sssd[p11_child[30764]]]] [main] (0x0020):
setgid failed: 1, p11_child might not work!
>>(Mon Aug 17 10:50:39:094746 2015) [[sssd[p11_child[30764]]]] [main] (0x2000):
Running with real IDs [499][499].
>>(Mon Aug 17 10:50:44:375594 2015) [[sssd[p11_child[30764]]]] [do_work] (0x4000):
Default Module List:
>>
>>It might be caused either by valgrind or by high load on machine.
>>IMHO changing default from 10 seconds to 30 is too much.
>>
>>We can use the same trick in dyndns_test
>>dyndns_tests_CFLAGS = \
>> $(AM_CFLAGS) \
>> -DDYNDNS_TIMEOUT=2
>>
>>and in pamsrv_cmd.c use conditional default value.
>>#ifndef SSS_P11_CHILD_TIMEOUT
>># define SSS_P11_CHILD_TIMEOUT 30
>>#endif
>>
>>
>>
>>>I'd like to talk to Sumit about what he thinks
>>>the proper solution should be. I am not sure
>>>if it times out because we do something
>>>unnecessary in p11 child.
>>>
>>>See the simple patch.
>>>
>>LS
>
>Thank you for comments. I pushed the newly attached
>patch to CI (5 times, essential tests only, with
>disabled be_req tests). To see if it fails. I
>am waiting for the results now.
>
I'm definitelly sure it will work.
I tested first version with hardcoded 30 seconds
and it passed more then 25 runs :-)
BTW it would be good to find out what is a reason
so big (3-5 seconds) timeouts.
>From 9b218d50bcfb31bbb8167ea9b02711de9a6de14b Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek(a)redhat.com>
>Date: Thu, 13 Aug 2015 14:03:24 +0200
>Subject: [PATCH] pam: Incerease p11 child timeout
>
>Ticket:
>https://fedorahosted.org/sssd/ticket/2746
>
>It was timeouting often in CI machines.
>---
ACK
* master: 9da121c08b785b56733a11fa46e14c708dda62e9