keyring: disk quota exceeded

[Ondrej Valousek]

Hi List,

Or RH-7 box I am getting message like this:

[root@spartacus bin]# kinit
kinit: Disk quota exceeded while getting default ccache

Google gave this: https://bugzilla.redhat.com/show_bug.cgi?id=1017683

Which suggests big keys needs to be enabled for kernel and suggests kernel 3.11
However, RHEL-7 is based on 3.10 kernels - do we know whether big Kerberos keys are
supported there?

Thanks,

Ondrej

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[John Hodrien]

On Wed, 27 Jul 2016, Ondrej Valousek wrote:

>  Hi List,
>
>  Or RH-7 box I am getting message like this:
>
>  [root@spartacus bin]# kinit
>  kinit: Disk quota exceeded while getting default ccache
>
>  Google gave this: https://bugzilla.redhat.com/show_bug.cgi?id=1017683
>
>  Which suggests big keys needs to be enabled for kernel and suggests kernel 3.11
>  However, RHEL-7 is based on 3.10 kernels - do we know whether big Kerberos keys are
> supported there? 
$ grep big_key /proc/keys

I'd say that was a yes.

jh

[Stephen Gallagher]

On 07/27/2016 06:12 AM, Ondrej Valousek wrote:
>  Hi List,
>  
>   
>  
>  Or RH-7 box I am getting message like this:
>  
>   
>  
>  [root@spartacus bin]# kinit
>  
>  kinit: Disk quota exceeded while getting default ccache
>  
>   
>  
>  Google gave this: https://bugzilla.redhat.com/show_bug.cgi?id=1017683
>  
>   
>  
>  Which suggests big keys needs to be enabled for kernel and suggests kernel 3.11
>  
>  However, RHEL-7 is based on 3.10 kernels – do we know whether big Kerberos keys
>  are supported there?
>  
>   
>   
Is this on a GNOME workstation? We recently discovered a bug in GNOME Online
Accounts that can (in rare circumstances) cause the keyring to fill up with
garbage which ends up preventing the legitimate values from being updated).

[John Hodrien]

On Wed, 27 Jul 2016, Stephen Gallagher wrote:

>  Is this on a GNOME workstation? We recently discovered a bug in GNOME
> Online
>  Accounts that can (in rare circumstances) cause the keyring to fill up with
>  garbage which ends up preventing the legitimate values from being updated). 
Have you got a BZ for this, or more details on what triggers it?

jh

[Ondrej Valousek]

It has Gnome installed, but none is using it.
I do not know what triggers it unfortunately. I just upgraded the kernel and rebooted the
machine hoping it won't come back.
I doubt Online Accounts might have caused that.

How do I found out which keyring is causing troubles?
Tried 'keyctl show' but it did not show anything interesting...
Ondrej

-----Original Message-----
From: John Hodrien [mailto:[e-mail]] 
Sent: Wednesday, July 27, 2016 2:39 PM
To: End-user discussions about the System Security Services Daemon
<sssd-users(a)lists.fedorahosted.org&gt;
Subject: [SSSD-users] Re: keyring: disk quota exceeded

On Wed, 27 Jul 2016, Stephen Gallagher wrote:

>  Is this on a GNOME workstation? We recently discovered a bug in GNOME
>
>  Online Accounts that can (in rare circumstances) cause the keyring to 
>  fill up with garbage which ends up preventing the legitimate values from being updated).
>  
Have you got a BZ for this, or more details on what triggers it?

jh
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/[e-mail]

-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[Stephen Gallagher]

On 07/27/2016 08:42 AM, Ondrej Valousek wrote:
>  It has Gnome installed, but none is using it. 

If GNOME is not in use, then this can't be the same problem, sorry. This only
happens if an active user is signed in to GNOME. And it only affects the current
user.

>  I do not know what triggers it unfortunately. I just upgraded the
> kernel and rebooted the machine hoping it won't come back.
>  I doubt Online Accounts might have caused that.
>  
>  How do I found out which keyring is causing troubles?
>  Tried 'keyctl show' but it did not show anything interesting...
>  Ondrej
>   
Next time it happens, can you send the output of `cat /proc/keys` (as the
affected user _not_ root) and `cat /proc/key-users` please? That will help.

[Ondrej Valousek]

Affected user was root actually :-/

-----Original Message-----
From: Stephen Gallagher [mailto:[e-mail]] 
Sent: Wednesday, July 27, 2016 3:22 PM
To: sssd-users(a)lists.fedorahosted.org
Subject: [SSSD-users] Re: keyring: disk quota exceeded

On 07/27/2016 08:42 AM, Ondrej Valousek wrote:
>  It has Gnome installed, but none is using it.
>  

If GNOME is not in use, then this can't be the same problem, sorry. This only happens
if an active user is signed in to GNOME. And it only affects the current user.

>  I do not know what triggers it unfortunately. I just upgraded the
> kernel and rebooted the machine hoping it won't come back.
>  I doubt Online Accounts might have caused that.
>  
>  How do I found out which keyring is causing troubles?
>  Tried 'keyctl show' but it did not show anything interesting...
>  Ondrej
>  
>  
Next time it happens, can you send the output of `cat /proc/keys` (as the affected user
_not_ root) and `cat /proc/key-users` please? That will help.


-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[Stephen Gallagher]

On 07/27/2016 09:25 AM, Ondrej Valousek wrote:
>  Affected user was root actually :-/
>   
If that's the case, the problem can't be an SSSD problem, because we don't
handle the root account...

[Ondrej Valousek]

Ok, next time I will file support case to SEG - see if it helps...
O.

-----Original Message-----
From: Stephen Gallagher [mailto:[e-mail]] 
Sent: Wednesday, July 27, 2016 3:42 PM
To: sssd-users(a)lists.fedorahosted.org
Subject: [SSSD-users] Re: keyring: disk quota exceeded

On 07/27/2016 09:25 AM, Ondrej Valousek wrote:
>  Affected user was root actually :-/
>  
>  
If that's the case, the problem can't be an SSSD problem, because we don't
handle the root account...



-----

The information contained in this e-mail and in any attachments is confidential and is
designated solely for the attention of the intended recipient(s). If you are not an
intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or
any part thereof. If you have received this e-mail in error, please notify the sender by
return e-mail and delete all copies of this e-mail from your computer system(s). Please
direct any additional queries to: communications(a)s3group.com. Thank You. Silicon and
Software Systems Limited (S3 Group). Registered in Ireland no. 378073. Registered Office:
South County Business Park, Leopardstown, Dublin 18.

[Stephen Gallagher]

On 07/27/2016 08:38 AM, John Hodrien wrote:
>  On Wed, 27 Jul 2016, Stephen Gallagher wrote:
>  
> > Is this on a GNOME workstation? We recently discovered a bug in GNOME Online
> > Accounts that can (in rare circumstances) cause the keyring to fill up with
> > garbage which ends up preventing the legitimate values from being updated).
>  
>  Have you got a BZ for this, or more details on what triggers it?
>   
Unfortunately, we never figured out how to reproduce it, but once it starts
happening, it happens on every boot. (By lucky coincidence, my personal systems
hit it, so we were able to validate the fix).


Upstream BZ is https://bugzilla.gnome.org/show_bug.cgi?id=768808

The patches are:

*
https://git.gnome.org/browse/gnome-online-accounts/commit/?id=607f9aea526...

*
https://git.gnome.org/browse/gnome-online-accounts/commit/?id=517fc9c4c88...