Segfault in COPR sssd 1.16.1-2 after upgrade to CentOS 7.5 from 7.4

[Lachlan Musicman]

Hola,

As per subject. Running COPR SSSD 1.16.1-2 happily on CentOS 7.4

Upgrade underlying to CentOS 7.5

SSSD segfaults

May 11 15:15:03 papr-res-compute34 systemd: Starting System Security
Services Daemon...
May 11 15:15:03 papr-res-compute34 sssd: Starting up
May 11 15:15:03 papr-res-compute34 kernel: sssd[10076]: segfault at
7ff7a3452d58 ip 00007ff7a3452d58 sp 00007ffe9a5aaca8 error 15 in
memberof.so[7ff7a3452000+1000]
May 11 15:15:03 papr-res-compute34 systemd: sssd.service: main process
exited, code=killed, status=11/SEGV
May 11 15:15:03 papr-res-compute34 systemd: Failed to start System Security
Services Daemon.
May 11 15:15:03 papr-res-compute34 systemd: Unit sssd.service entered
failed state.
May 11 15:15:03 papr-res-compute34 systemd: sssd.service failed.

That's all I get in the logs

Cheers
L.

[Lukas Slebodnik]

On (11/05/18 15:21), Lachlan Musicman wrote:
> Hola,
>
> As per subject. Running COPR SSSD 1.16.1-2 happily on CentOS 7.4
>
> Upgrade underlying to CentOS 7.5
>
> SSSD segfaults
>
> May 11 15:15:03 papr-res-compute34 systemd: Starting System Security
> Services Daemon...
> May 11 15:15:03 papr-res-compute34 sssd: Starting up
> May 11 15:15:03 papr-res-compute34 kernel: sssd[10076]: segfault at
> 7ff7a3452d58 ip 00007ff7a3452d58 sp 00007ffe9a5aaca8 error 15 in
> memberof.so[7ff7a3452000+1000] 
That's caused by recent upgrade of libldb in CentOS7

---> Package libldb.x86_64 0:1.1.29-1.el7 will be updated
---> Package libldb.x86_64 0:1.2.2-1.el7 will be an update

Packages in copr need to be rebuilt with newer version of libldb.

You might try to downgrade libldb but I am not sure whether it will be
possible.

LS

[Lachlan Musicman]

I'll wait :) I've only deployed to dev servers, so being broken is not a
problem/urgent rush.

Thanks Lukas

Cheers
L.

------
"The antidote to apocalypticism is *apocalyptic civics*. Apocalyptic civics
is the insistence that we cannot ignore the truth, nor should we panic
about it. It is a shared consciousness that our institutions have failed
and our ecosystem is collapsing, yet we are still here — and we are
creative agents who can shape our destinies. Apocalyptic civics is the
conviction that the only way out is through, and the only way through is
together. "

*Greg Bloom* @greggish
https://twitter.com/greggish/status/873177525903609857

On 11 May 2018 at 17:08, Lukas Slebodnik <lslebodn(a)redhat.com&gt; wrote:

>  On (11/05/18 15:21), Lachlan Musicman wrote:
>  >Hola,
>  >
>  >As per subject. Running COPR SSSD 1.16.1-2 happily on CentOS 7.4
>  >
>  >Upgrade underlying to CentOS 7.5
>  >
>  >SSSD segfaults
>  >
>  >May 11 15:15:03 papr-res-compute34 systemd: Starting System Security
>  >Services Daemon...
>  >May 11 15:15:03 papr-res-compute34 sssd: Starting up
>  >May 11 15:15:03 papr-res-compute34 kernel: sssd[10076]: segfault at
>  >7ff7a3452d58 ip 00007ff7a3452d58 sp 00007ffe9a5aaca8 error 15 in
>  >memberof.so[7ff7a3452000+1000]
>
>  That's caused by recent upgrade of libldb in CentOS7
>
>  ---> Package libldb.x86_64 0:1.1.29-1.el7 will be updated
>  ---> Package libldb.x86_64 0:1.2.2-1.el7 will be an update
>
>  Packages in copr need to be rebuilt with newer version of libldb.
>
>  You might try to downgrade libldb but I am not sure whether it will be
>  possible.
>
>  LS
>  _______________________________________________
>  sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org
>

[Jakub Hrozek]

On Fri, May 11, 2018 at 06:32:46PM +1000, Lachlan Musicman wrote:
>  I'll wait :) I've only deployed to dev servers, so being
> broken is not a
>  problem/urgent rush. 
Can you file a bug upstream so that we remember to rebuild the repo?

[Lukas Slebodnik]

On (11/05/18 18:32), Lachlan Musicman wrote:
> I'll wait :) I've only deployed to dev servers, so being
> broken is not a
> problem/urgent rush.
>  
BTW do you really need to use sssd from copr?

The default version in el7.5 should be almost equivalent
1.16.0-19.el7

Or do you need some specific bug fixes which are only
in upstream (and thus copr)?

LS

[Lachlan Musicman]

On 12 May 2018 at 01:42, Lukas Slebodnik <lslebodn(a)redhat.com&gt; wrote:

>  On (11/05/18 18:32), Lachlan Musicman wrote:
>  >I'll wait :) I've only deployed to dev servers, so being broken is not a
>  >problem/urgent rush.
>  >
>
>  BTW do you really need to use sssd from copr?
>
>  The default version in el7.5 should be almost equivalent
>  1.16.0-19.el7
>
>  Or do you need some specific bug fixes which are only
>  in upstream (and thus copr)?
>  
That's a good question - I was thinking about it yesterday afternoon. I
don't know that we do, but I will need to do some testing. We moved to COPR
back when 1.15 had bufixes that 1.14 in EPEL didn't, but that was a while
ago now. Because we host our own repos with Foreman/Katello, I've kept COPR
as one.

Is there an easy way to "downgrade"?

Cheers
L.

[Lachlan Musicman]

On 11 May 2018 at 20:12, Jakub Hrozek <jhrozek(a)redhat.com&gt; wrote:

>  On Fri, May 11, 2018 at 06:32:46PM +1000, Lachlan Musicman wrote:
>  > I'll wait :) I've only deployed to dev servers, so being broken is not a
>  > problem/urgent rush.
>
>  Can you file a bug upstream so that we remember to rebuild the repo?
>  
Ack.
Cheers
L.

[Lachlan Musicman]

On 12 May 2018 at 11:01, Lachlan Musicman <datakid(a)gmail.com&gt; wrote:

>  On 12 May 2018 at 01:42, Lukas Slebodnik <lslebodn(a)redhat.com&gt;
> wrote:
>
> > On (11/05/18 18:32), Lachlan Musicman wrote:
> > >I'll wait :) I've only deployed to dev servers, so being broken is not a
> > >problem/urgent rush.
> > >
> >
> > BTW do you really need to use sssd from copr?
> >
> > The default version in el7.5 should be almost equivalent
> > 1.16.0-19.el7
> >
> > Or do you need some specific bug fixes which are only
> > in upstream (and thus copr)?
> >
>
>  That's a good question - I was thinking about it yesterday afternoon. I
>  don't know that we do, but I will need to do some testing. We moved to COPR
>  back when 1.15 had bufixes that 1.14 in EPEL didn't, but that was a while
>  ago now. Because we host our own repos with Foreman/Katello, I've kept COPR
>  as one.
>
>  Is there an easy way to "downgrade"?
>  

Would appreciate some pointers here. From my initial testing it looks like
I might be stuck with rebuild and/or re-install ipa-client/sssd.

yum downgrade sssd ->
yum downgrade sssd* libsss* ->
yum downgrade sssd* libsss* libipa_hbac python2-sssdconfig ->
yum downgrade sssd* libsss* libipa_hbac* python2-sssdconfig*
python2-libipa_hbac* python-sssdconfig*:

all fail, the last with

---> Package python-sssdconfig.noarch 0:1.16.0-19.el7 will be installed
Removing python-sssdconfig.noarch 0:1.16.0-19.el7 - u due to obsoletes from
installed python2-sssdconfig-1.16.1-2.el7.centos.noarch
--> Restarting Dependency Resolution with new changes.
--> Running transaction check
---> Package libipa_hbac.x86_64 0:1.16.1-2.el7.centos will be erased
---> Package python-sssdconfig.noarch 0:1.16.0-19.el7 will be installed
--> Processing Dependency: python-sssdconfig = 1.16.0-19.el7 for package:
sssd-1.16.0-19.el7.x86_64
--> Finished Dependency Resolution
Error: Package: sssd-1.16.0-19.el7.x86_64 (CentOS_7_x86_64_Base)
           Requires: python-sssdconfig = 1.16.0-19.el7
           Installed: python2-sssdconfig-1.16.1-2.el7.centos.noarch
(@_sssd_SSSD_1_16_1_COPR)
               python-sssdconfig = 1.16.1-2.el7.centos
Error: Package: python2-libipa_hbac-1.16.1-2.el7.centos.x86_64
(@_sssd_SSSD_1_16_1_COPR)
           Requires: libipa_hbac = 1.16.1-2.el7.centos
           Removing: libipa_hbac-1.16.1-2.el7.centos.x86_64
(@_sssd_SSSD_1_16_1_COPR)
               libipa_hbac = 1.16.1-2.el7.centos
           Downgraded By: libipa_hbac-1.16.0-19.el7.x86_64
(CentOS_7_x86_64_Base)
               libipa_hbac = 1.16.0-19.el7
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest


Cheers
L.

[Lachlan Musicman]

On 14 May 2018 at 09:15, Lachlan Musicman <datakid(a)gmail.com&gt; wrote:

>  On 12 May 2018 at 11:01, Lachlan Musicman <datakid(a)gmail.com&gt; wrote:
>
> > On 12 May 2018 at 01:42, Lukas Slebodnik <lslebodn(a)redhat.com&gt; wrote:
> >
> >> On (11/05/18 18:32), Lachlan Musicman wrote:
> >> >I'll wait :) I've only deployed to dev servers, so being broken is
> not a
> >> >problem/urgent rush.
> >> >
> >>
> >> BTW do you really need to use sssd from copr?
> >>
> >> The default version in el7.5 should be almost equivalent
> >> 1.16.0-19.el7
> >>
> >> Or do you need some specific bug fixes which are only
> >> in upstream (and thus copr)?
> >>
> >
> > That's a good question - I was thinking about it yesterday afternoon. I
> > don't know that we do, but I will need to do some testing. We moved to COPR
> > back when 1.15 had bufixes that 1.14 in EPEL didn't, but that was a while
> > ago now. Because we host our own repos with Foreman/Katello, I've kept COPR
> > as one.
> >
> > Is there an easy way to "downgrade"?
> >
>  
This is for those that come behind me. To uninstall, this command seems to
remove everything that a new install of ipa-client will complain about:

yum remove sss* ipa-client libipa_hbac libsss_* python2-sssdconfig

Cheers
L.

[Lachlan Musicman]

On 14 May 2018 at 15:05, Lachlan Musicman <datakid(a)gmail.com&gt; wrote:

>  On 14 May 2018 at 09:15, Lachlan Musicman <datakid(a)gmail.com&gt;
> wrote:
>
> >
> > On 12 May 2018 at 11:01, Lachlan Musicman <datakid(a)gmail.com&gt; wrote:
> >
> >> On 12 May 2018 at 01:42, Lukas Slebodnik <lslebodn(a)redhat.com&gt; wrote:
> >>
> >>> On (11/05/18 18:32), Lachlan Musicman wrote:
> >>> >I'll wait :) I've only deployed to dev servers, so being broken
> is not
> >>> a
> >>> >problem/urgent rush.
> >>> >
> >>>
> >>> BTW do you really need to use sssd from copr?
> >>>
> >>> The default version in el7.5 should be almost equivalent
> >>> 1.16.0-19.el7
> >>>
> >>> Or do you need some specific bug fixes which are only
> >>> in upstream (and thus copr)?
> >>>
> >>
> >> That's a good question - I was thinking about it yesterday afternoon. I
> >> don't know that we do, but I will need to do some testing. We moved to COPR
> >> back when 1.15 had bufixes that 1.14 in EPEL didn't, but that was a while
> >> ago now. Because we host our own repos with Foreman/Katello, I've kept COPR
> >> as one.
> >>
> >> Is there an easy way to "downgrade"?
> >>
> >
>  This is for those that come behind me. To uninstall, this command seems to
>  remove everything that a new install of ipa-client will complain about:
>
>  yum remove sss* ipa-client libipa_hbac libsss_* python2-sssdconfig
>  

There is a better way, and I found it via
https://unix.stackexchange.com/questions/39887/is-there-a-way-to-install-...

Using yum shell to migrate from COPR sssd 1.16.1-7 to EPEL sssd-1-16.0.19:

downgrade sssd sssd-* libsss_* libipa_*
swap python2-sssdconfig python-sssdconfig
swap python2-libipa_hbac python-libipa_hbac
run

Runs all three commands simultaneously, solving the problem of just trying
to downgrade failing - the two swap commands solve those errors that yum
throws.

Cheers
L.