Bug 743983

Summary:	openldap-servers-2.4.19 uses newer version of db4 than openldap-servers-2.4.23
Product:	Red Hat Enterprise Linux 6	Reporter:	Vaidas Jablonskis <jablonskis>
Component:	openldap	Assignee:	Jan Vcelak <jvcelak>
Status:	CLOSED CANTFIX	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.1	CC:	jplans, jvcelak, pasteur, tsmetana
Target Milestone:	rc
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-02-07 09:29:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vaidas Jablonskis 2011-10-06 16:33:03 UTC

Description of problem:

Current version of openldap-servers-2.4.19 in RHEL6.0 uses embedded berkeley db version 4.8.x. After an update to RHEL6.1, openldap-servers gets updated to 2.4.23 which does not have berkeley db embedded and uses system-wide db4 which is v4.7.

So basically if you have openldap running and using bdb backend db on RHEL6.0 and you update the system to RHEL6.1 the slapd starts to complain that the DB environment is actually newer than the application which is trying to access it.


Version-Release number of selected component (if applicable):

openldap-servers-2.4.23

How reproducible:

every single time


Steps to Reproduce:
1. install openldap-servers-2.4.19
2. create a database, import some data
3. update openldap-servers to 2.4.23
4. the update process will try to restart a slapd service, but it will fail


Actual results:
ldap.log when trying to start slapd 2.4.23:
--
Oct  6 12:11:26 lada slapd[15593]: bdb(dc=foo,dc=com): Program version 4.7 doesn't match environment version 4.8
Oct  6 12:11:26 lada slapd[15593]: bdb_db_open: database "dc=foo,dc=com" cannot be opened, err -30971. Restore from backup!
Oct  6 12:11:26 lada slapd[15593]: bdb(dc=foo,dc=com): txn_checkpoint interface requires an environment configured for the transaction subsystem
Oct  6 12:11:26 lada slapd[15593]: bdb_db_close: database "dc=foo,dc=com": txn_checkpoint failed: Invalid argument (22).
Oct  6 12:11:26 lada slapd[15593]: backend_startup_one (type=bdb, suffix="dc=foo,dc=com"): bi_db_open failed! (-30971)
Oct  6 12:11:26 lada slapd[15593]: bdb_db_close: database "dc=foo,dc=com": alock_close failed
Oct  6 12:11:26 lada slapd[15593]: slapd stopped.
---


Expected results:

I expect the RHEL6.1 also include upgrades for db4 to 4.8.x or some technique on how to downgrade an openldap db files to 4.7.x version of db4.

Additional info:

Comment 2 RHEL Program Management 2011-10-07 16:02:11 UTC

Since RHEL 6.2 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.

Comment 3 Tru Huynh 2012-02-06 22:47:39 UTC

also reported at http://bugs.centos.org/view.php?id=5494

Comment 4 Jan Vcelak 2012-02-07 09:29:00 UTC

OpenLDAP was shipped with embedded libdb, which was no good from security reasons. We removed it during OpenLDAP rebase between RHEL6 and RHEL6.1. System libdb is used now.

Please, export your database before upgrade, and reimport it back after the upgrade. And we are sorry for the inconvenience.